CGOA Practice Test 24 — 15 Questions

Question 1

What is the primary function of an 'ApplicationSet' in Argo CD?

Accepted Answer

To automate the creation of Argo CD Applications.. An ApplicationSet in Argo CD is a controller that automates the generation of Argo CD Applications from a template plus a generator (such as a Git directory, cluster list, or pull request generator). It allows one ApplicationSet manifest to produce many Applications, which is essential for multi-cluster and multi-tenant GitOps at scale.

Answer

To perform unit testing on manifests.

Answer

To manage cluster security policies.

Answer

To automatically update the Git repo with new commits.

Question 2

An organization is migrating to GitOps using Argo CD. During an audit, you notice that manual changes made directly to the Kubernetes cluster via kubectl are being reverted within minutes. Which component of the GitOps pipeline is performing this action?

Accepted Answer

The Application Controller. The Argo CD Application Controller is the component that continuously monitors live cluster state against the desired state in Git and performs reconciliation. When it detects drift (e.g., a manual kubectl change), and the Application has automated sync with self-heal enabled, the Application Controller re-applies the Git-defined manifests, reverting the manual change. It is the engine behind Argo CD's drift correction.

Answer

The cluster ingress controller

Answer

The Argo CD API server

Answer

The Git webhook listener

Question 3

You are using Argo Rollouts for progressive delivery. You want to execute a 'AnalysisRun' before switching traffic. Where is the 'AnalysisTemplate' defined?

Accepted Answer

As a Kubernetes resource in Git.. An AnalysisTemplate is a Kubernetes custom resource (CRD) that defines how to query a metric provider (Prometheus, Datadog, etc.) and what thresholds constitute success or failure. Like all GitOps artifacts, it must be declared as a Kubernetes resource stored in Git so the operator can create AnalysisRuns from it during a rollout.

Answer

In the Argo CD global configuration file.

Answer

Hardcoded in the application binary.

Answer

By the Service Mesh control plane directly.

Question 4

What is the primary role of the 'Git' repository in the GitOps cycle?

Accepted Answer

To be the single source of truth for the desired system state.. In GitOps, the Git repository is the single source of truth: it holds the declarative manifests that define the desired state of the entire system. Controllers continuously compare the cluster's actual state to what Git declares and reconcile any drift. This makes Git the authoritative record for both configuration and change history.

Answer

To monitor the health of the nodes.

Answer

To manage user identities.

Answer

To store container binary files.

Question 5

In a multi-cluster GitOps environment, you are using the ApplicationSet controller with a 'Cluster Generator'. You need to add a new cluster dynamically without modifying the ApplicationSet manifest. How should you achieve this?

Accepted Answer

Add a secret with the label 'argocd.argoproj.io/secret-type: cluster' to the management cluster.. The Argo CD ApplicationSet Cluster Generator reads cluster definitions from Secrets in the Argo CD namespace that carry the label 'argocd.argoproj.io/secret-type: cluster'. Adding such a Secret dynamically registers the new cluster, and the generator automatically produces Applications for it without editing the ApplicationSet manifest.

Answer

Update the ApplicationSet manifest via a manual Git commit.

Answer

Execute 'argocd cluster add' via the CLI.

Answer

Modify the 'clusters.yaml' file in the root Git repository.

Question 6

Which THREE features of Kubernetes are commonly used to support GitOps?

Accepted Answer

The Kubernetes API for resource management.. Option A is correct because GitOps tools such as Argo CD and Flux reconcile the desired state stored in Git by continuously reading and writing resources through the Kubernetes API, which is the declarative control plane interface for creating, updating, and watching objects. Option C is correct because namespaces provide logical isolation and scoping for configuration, allowing GitOps-managed manifests and their associated RBAC, quotas, and policies to be separated per team, environment, or application. Option D is correct because RBAC restricts which users and service accounts can apply or modify resources, which is essential for GitOps controllers to have least-privilege permissions to sync Git-declared state without granting broad cluster-admin access. Option B is not a GitOps-supporting feature in this context because node labels are used by the scheduler for pod placement and do not implement declarative Git-to-cluster reconciliation. Option E is not relevant because internal clock synchronization supports time consistency for logs, certificates, and scheduling, but it is not a Kubernetes feature used to enable GitOps workflows.

Answer

Node labels for scheduling.

Answer

The cluster's internal clock synchronization.

Question 7

Which TWO of the following are common benefits of using a 'GitOps Operator'? (Select two)

Accepted Answer

They provide a single, declarative source of truth.. Option C is correct because a GitOps Operator treats a Git repository as the single, declarative source of truth, so the desired state of the cluster is defined in version-controlled manifests and continuously reconciled from there. Option D is correct because the operator runs a continuous reconciliation loop that compares the live cluster state against the declared state, detects drift, and automatically corrects it back to the desired configuration. Options A, B, and E are not benefits of a GitOps Operator: it does not manually restart servers on every change (it reconciles declaratively), it does not require cluster-admin privileges merely to view logs, and it does not eliminate the need for container images since workloads still run as containers.

Answer

They manually restart the server every time a change is detected.

Answer

They require the user to have cluster-admin privileges to see the logs.

Answer

They eliminate the need for container images.

Question 8

A platform team manages a Kubernetes cluster with Flux. They want to ensure that if the cluster's live state diverges from the Git repository, the system automatically corrects it without human intervention. Which GitOps concept does this describe?

Accepted Answer

Reconciliation. Reconciliation is the continuous process by which a GitOps operator like Flux or Argo CD compares the desired state stored in Git with the actual state of the cluster and automatically applies any necessary changes to eliminate drift. This self-healing behavior is exactly what the platform team requires to maintain consistency without manual intervention.

Answer

Immutable Infrastructure

Answer

Continuous Delivery

Answer

Declarative Configuration

Question 9

A company uses Flux to manage a Kubernetes cluster. During a recent security audit, they found that an engineer manually edited a ConfigMap directly in the live cluster using 'kubectl edit', causing the cluster state to drift from the Git repository. The engineer wants to ensure that such manual changes are automatically reverted to match Git. Which GitOps principle should they enforce?

Accepted Answer

Continuous reconciliation. Continuous reconciliation ensures the cluster state is continuously compared to the desired state in Git and any drift is corrected. Manual edits like the ConfigMap change are automatically reverted, enforcing the Git repository as the single source of truth. This principle is fundamental to GitOps and is implemented by tools like Flux and Argo CD.

Answer

Declarative configuration

Answer

Pull-based reconciliation

Answer

Immutable infrastructure

Question 10

You are using Flux CD to manage a multi-tenant cluster. Each tenant has its own Git repository and namespace. You want to ensure that a tenant's Kustomization can only deploy resources into its own namespace and cannot modify cluster-scoped resources. Which Flux feature should you configure?

Accepted Answer

Use Flux's multi-tenancy lockdown with a service account that has limited RBAC permissions.. Flux's multi-tenancy lockdown uses impersonation with a restricted service account. By binding the tenant's Kustomization to a service account that only has permissions within its namespace, you enforce that it cannot create or modify cluster-scoped resources. This pattern is essential for secure multi-tenant GitOps and aligns with the principle of least privilege.

Answer

Set the targetNamespace field in the Kustomization to the tenant's namespace and enable prune.

Answer

Enable the Kustomization's health checks to validate that all resources are namespaced.

Answer

Configure the Kustomization to use a SOPS decryption key that is scoped to the tenant's namespace.

Question 11

A team adopting GitOps wants to reduce the blast radius of a bad change and shorten mean time to recovery. They already store all manifests in Git and use an operator for reconciliation. Which practice most directly limits the impact of a faulty change reaching production?

Accepted Answer

Use progressive delivery with canary or blue-green rollouts gated by automated health checks.. Limiting blast radius means a defective change should affect as little as possible before it is detected. Progressive delivery with canary or blue-green strategies and automated health gates achieves exactly that: the new version serves a small slice first and is promoted only on success, with automatic rollback on failure. Reconciliation interval tuning, broad production access, and removing review do not constrain the spread or detection of a bad change.

Answer

Grant all engineers write access to the production cluster so they can patch issues directly.

Answer

Increase the reconciliation interval so the operator checks Git less frequently.

Answer

Store manifests in a single branch and disable pull request reviews to speed up merges.

Question 12

A team uses Flux to manage a cluster. They want the cluster to automatically apply new commits to a configuration repository without any external pipeline pushing to the cluster. Which Flux component and behavior accomplish this?

Accepted Answer

The source-controller watches the Git repository and produces an artifact that the kustomize-controller reconciles into the cluster.. Flux's pull-based model is implemented by the source-controller fetching repository content and producing artifacts that the kustomize-controller then reconciles into the cluster. This lets in-cluster agents detect and apply new commits without external pipeline credentials. The notification, helm, and image-reflector controllers serve different roles and do not themselves apply the changed manifests from Git.

Answer

The notification-controller receives webhooks from the Git host and applies the changed manifests itself.

Answer

The helm-controller polls the Git repository directly and renders charts during each reconciliation cycle.

Answer

The image-reflector-controller scans the container registry and commits updated tags back to the configuration repository.

Question 13

You are using Flux with a GitRepository source that points to a private Git repository over HTTPS. Flux is failing to fetch the repository with an authentication error. You have created a Kubernetes Secret with the username and password. Which field in the GitRepository spec must reference this Secret?

Accepted Answer

spec.secretRef. In Flux, authentication for GitRepository sources is configured by referencing a Kubernetes Secret in the spec.secretRef field. This Secret must contain the appropriate credentials, such as username and password for HTTPS. The other options are not valid API fields, so they cannot be used to provide credentials.

Answer

spec.auth

Answer

spec.credentials

Answer

spec.sshCredentials

Question 14

A company is adopting GitOps and wants to ensure their implementation follows the core principles. They are reviewing their current practices and need to identify which of the following are considered core GitOps principles. (Choose two.)

Accepted Answer

Automated reconciliation. The core GitOps principles include declarative configuration, Git as the single source of truth, automated reconciliation, and pull-based deployment. Among the options, declarative configuration and automated reconciliation are explicitly core principles. Manual approval for every change and push-based deployment contradict GitOps automation and pull-based models, while immutable infrastructure is a related but not core principle.

Answer

Push-based deployment

Answer

Manual approval for every change

Answer

Immutable infrastructure

Question 15

A startup is adopting GitOps for its Kubernetes platform. The CTO asks the platform engineer to describe the defining property of the deployment model they are about to adopt. Which statement best captures the core GitOps principle?

Accepted Answer

The desired state of the system is declared in Git, and automated agents continuously converge the running system toward it.. GitOps is defined by declarative desired state stored in Git plus automated agents that continuously reconcile the running system to match it. Push-based pipelines, ticketing gates, and operator patterns are related but not the defining property. The convergence loop and the versioned declarative source are what make the model auditable, reproducible, and self-healing.

Answer

Operators package application logic into custom controllers that manage the full lifecycle of their own resources.

Answer

Every production change requires a change advisory board approval recorded in an external ticketing system before deployment.

Answer

Application artifacts are built in CI and pushed to the cluster by the pipeline after every merge to the main branch.