CGOA Practice Test 22 — 15 Questions

Question 1

A platform team manages 50 Kubernetes clusters using GitOps. They need to ensure that an emergency rollback of an application across all clusters can be executed cleanly and audited effectively. What is the standard GitOps mechanism to achieve this rollback?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Revert the bad commit in the Git repository using 'git revert' and merge the change.. In GitOps, the desired state is stored in Git, so rolling back an application is done by reverting the bad commit in Git and merging it. The GitOps controller then reconciles the clusters to the reverted state, providing a clean, auditable rollback across all clusters.

Answer

Execute 'helm rollback' on each individual cluster CLI in parallel.

Answer

Delete the target namespace in each cluster and let the API server re-download the manifest from cache.

Answer

Power down the GitOps controller pods so the clusters automatically default to their initial factory settings.

Question 2

Which THREE of these are valid methods for handling configuration differences across environments (e.g., Dev vs Prod)?

Accepted Answer

Using separate directories for each environment's manifests.. Option A is correct because maintaining separate directories per environment (e.g., overlays/dev, overlays/prod or manifests/dev, manifests/prod) is a standard GitOps-friendly pattern that keeps environment-specific manifests isolated and version-controlled. Option B is correct because Helm values files (e.g., values-dev.yaml, values-prod.yaml) let you override chart parameters per environment via helm install -f values-prod.yaml, cleanly separating configuration from templated manifests. Option E is correct because Kustomize overlays (kustomization.yaml with bases and overlays) are purpose-built for patching a common base with environment-specific changes such as replicas, image tags, or resource limits. Option C is not a valid method because manually SSHing into nodes to run sed is imperative, unversioned, and unreproducible, causing configuration drift. Option D is not valid because hardcoding every environment into one massive file creates tight coupling, raises error risk, and defeats the separation-of-concerns that these declarative tools provide.

Answer

Manually SSHing into nodes to run sed.

Answer

Hardcoding every environment in one massive file.

Question 3

You have a Git repository that contains multiple Kustomizations. You want Flux to update all of them based on a single trigger. How should you structure the repository?

Accepted Answer

Using a base directory and multiple overlays. Using a base directory and multiple overlays is the correct approach because Kustomize's base/overlay pattern allows a single Git repository to contain multiple Kustomizations that share common resources. When Flux detects a change in the repository, it can trigger reconciliation for all Kustomizations that reference the same base or overlays, enabling a single trigger to update all of them. This structure promotes DRY principles and simplifies management of multiple environments or variants from one source of truth.

Answer

Using one Git repo per application

Answer

Disabling Kustomize

Answer

Combining all manifests into one large file

Question 4

A company uses Terraform for IaC and Argo CD for application delivery. How should they manage the dependency between infrastructure provisioning and app deployment to ensure GitOps consistency?

Accepted Answer

Use Crossplane to represent infrastructure as Kubernetes objects, managing both IaC and apps via GitOps.. Crossplane extends Kubernetes with CRDs so infrastructure (cloud resources, databases, networks) is represented as Kubernetes objects, meaning Argo CD can reconcile both infrastructure and application manifests from Git using the same GitOps control loop. This eliminates the ordering problem because Argo CD's sync waves and health checks can sequence infrastructure readiness before dependent apps deploy. The other options break GitOps consistency by introducing imperative, out-of-band steps.

Answer

Execute Terraform via a CI job that triggers Argo CD after completion.

Answer

Manually trigger Terraform runs before pushing new app manifests to Git.

Answer

Embed Terraform binary execution within a K8s deployment container.

Question 5

You are using OPA Gatekeeper with GitOps. You want to prevent any deployment that does not have an 'owner' label. Where should this policy be applied to ensure it is enforced for all GitOps-driven changes?

Accepted Answer

Validating Admission Webhook. OPA Gatekeeper enforces policies through a Validating Admission Webhook registered with the Kubernetes API server, so every create/update request — including those from Flux or ArgoCD — is evaluated before persistence. This guarantees the 'owner' label requirement is enforced regardless of how the manifest reaches the cluster.

Answer

Git pre-receive hook

Answer

Flux Source Controller

Answer

ArgoCD AppProject

Question 6

Which TWO items are typically included in a GitOps repository?

Accepted Answer

Kustomize overlays or Helm charts.. Option B (Kustomize overlays or Helm charts) is correct because a GitOps repository stores the declarative configuration that defines the desired state of the cluster, and Kustomize overlays and Helm charts are the standard templating/packaging tools used to express environment-specific Kubernetes configuration. Option D (Kubernetes manifest files) is correct because GitOps relies on version-controlled YAML manifests (Deployments, Services, ConfigMaps, etc.) as the single source of truth that an agent such as Argo CD or Flux continuously reconciles against the live cluster. Option A (user password lists) does not belong because secrets must never be committed in plaintext to Git; they are handled via sealed secrets, SOPS, or external secret managers. Option C (database backups) does not belong because backups are runtime data artifacts stored in object storage or backup systems, not declarative desired-state configuration. Option E (application source code) does not belong because the application code lives in its own source repository and is built into container images by CI, while the GitOps repo holds only the deployment/configuration manifests.

Answer

User password lists.

Answer

Database backups.

Answer

Application source code.

Question 7

You are using ArgoCD and need to ensure that a Helm chart is rendered correctly with a specific set of values. Where do you specify these values in the ArgoCD Application resource?

Accepted Answer

spec.source.helm.values. In an ArgoCD Application resource, Helm values are specified under spec.source.helm.values, which is the field ArgoCD reads when rendering the chart. This allows you to override chart defaults with a specific set of values. The other paths do not exist in the Application CRD.

Answer

spec.syncPolicy.values

Answer

spec.parameters

Answer

spec.destination.values

Question 8

In a GitOps workflow, where does the 'source of truth' reside?

Accepted Answer

In the Git repository.. In GitOps, the Git repository is the single source of truth because it declaratively stores the desired state of the entire system — manifests, Helm charts, Kustomize overlays, and configuration. Controllers continuously reconcile the live cluster state against this repository, so any drift or change must be committed to Git first. This makes Git the authoritative record of what should be running.

Answer

In the application's environment variables.

Answer

In the Kubernetes etcd database.

Answer

In the developer's local workstation.

Question 9

What happens if the 'revision' in an Argo CD Application points to a branch that does not exist?

Accepted Answer

The application will be marked as 'Invalid' or 'Degraded'.. If the revision points to a non-existent branch, Argo CD cannot resolve the desired state, so the Application's sync status becomes Unknown/Invalid and health may show Degraded or Missing. It does not fall back to another branch or create one. The controller continues running; only that Application is affected.

Answer

It will create the branch automatically.

Answer

It will stop the Argo CD controller.

Answer

It will sync the 'main' branch instead.

Question 10

You want to use Helm for your GitOps deployments. Where should the 'values.yaml' file reside for environment-specific overrides?

Accepted Answer

In the Git repository, per environment.. Environment-specific values.yaml overrides must live in Git, organized per environment (e.g., envs/dev/values.yaml, envs/prod/values.yaml), so the GitOps operator can render the chart with the correct values for each target cluster. This keeps Git as the single source of truth and makes environment differences reviewable and auditable.

Answer

In a local machine folder not tracked by Git.

Answer

In the Argo CD global settings.

Answer

Inside the container image.

Question 11

What is the primary benefit of using a pull-based GitOps operator compared to a push-based CI/CD system?

Accepted Answer

The cluster does not need inbound access from the CI pipeline.. In a pull-based GitOps model, the operator runs inside the cluster and continuously pulls the desired state from Git. This means the CI system does not need to connect to the cluster's API server, eliminating the need for inbound access to the cluster from external systems. This improves security by reducing the attack surface.

Answer

It eliminates the need for container registries.

Answer

You can use fewer Git branches.

Answer

The CI system runs faster.

Question 12

Which THREE of the following are valid components of the ArgoCD architecture?

Accepted Answer

API Server. The ArgoCD architecture is composed of three main components: the API Server (A), which exposes the gRPC/REST API used by the Web UI, CLI, and CI systems and handles authentication, RBAC, and application management; the Application Controller (B), which continuously monitors running applications and compares live state against the desired state defined in Git (a Kubernetes controller that performs sync/health assessment); and the Repo Server (C), which maintains a local cache of Git repositories and generates Kubernetes manifests by rendering Helm charts, Kustomize, or plain YAML. Options D (Source Controller) and E (Kustomization Controller) are not ArgoCD components — Source Controller is part of Flux (Flux's source-controller), and Kustomization Controller is also a Flux component (kustomize-controller), so neither belongs to the ArgoCD architecture.

Answer

Source Controller

Answer

Kustomization Controller

Question 13

Why do you use a separate repository for application code and application manifests (deployment manifests) in GitOps?

Accepted Answer

To allow different teams to manage code and configuration independently and securely.. Separating application code from deployment manifests lets different teams own their respective concerns: developers control code and CI, while platform or ops teams control deployment configuration, environment-specific values, and security policies. This separation also enforces least privilege — developers may not need write access to production manifests, and auditors can review config changes independently of code changes.

Answer

It is required by the Kubernetes specification.

Answer

Because they are written in different languages.

Answer

It makes the CI/CD pipeline run faster.

Question 14

Which THREE of the following are benefits of using the App-of-Apps pattern? (Select THREE)

Accepted Answer

Centralized management of multiple applications.. Option A is correct because the App-of-Apps pattern uses a parent Argo CD Application that points to a Git repository containing multiple child Application manifests, giving a single control point to manage many applications declaratively. Option C is correct because Argo CD renders the parent and its child Applications as a hierarchical tree in the UI, making it easy to visualize the relationships and health of related applications. Option D is correct because syncing the parent Application triggers reconciliation of the child Application resources, allowing all related applications to be synced together from one action. Option B is not correct because App-of-Apps is an Argo CD application organization pattern and does not remove the need for Helm or any other templating/packaging tool. Option E is not correct because App-of-Apps does not perform automatic promotion of code between environments; promotion is handled by separate CI/CD or GitOps promotion workflows.

Answer

Elimination of the need for Helm.

Answer

Automatic promotion of code between environments.

Question 15

What is the key difference between Configuration as Code and Infrastructure as Code in the context of GitOps?

Accepted Answer

IaC defines the underlying resources, while Config as Code defines the application-level settings.. Infrastructure as Code (IaC) defines the underlying resources — VMs, networks, clusters, storage — while Configuration as Code defines application-level settings such as environment variables, feature flags, and service configuration. In GitOps, both are stored in Git, but they operate at different layers of the stack.

Answer

Configuration as Code is only for databases.

Answer

Config as Code is always written in YAML.

Answer

They are the same thing.