CGOA Practice Test 3 — 25 Questions

Question 1

Which THREE of the following are essential security practices for GitOps? (Select three)

Accepted Answer

Strict RBAC for both the Git repository and the Kubernetes cluster.. GitOps security relies on repository access controls, secret management, and policy enforcement (like OPA) to ensure the system remains compliant.

Answer

Giving every developer direct 'cluster-admin' access.

Answer

Sharing the Git repository password with all cluster users.

Question 2

Which THREE of the following are benefits of using the App-of-Apps pattern? (Select THREE)

Accepted Answer

Centralized management of multiple applications.. The App-of-Apps pattern simplifies management by providing a single point of visibility, enabling bulk operations, and allowing for hierarchical organization of applications.

Answer

Elimination of the need for Helm.

Answer

Automatic promotion of code between environments.

Question 3

Which of the following is NOT a benefit of the GitOps model?

Accepted Answer

Increased system performance.. GitOps does not necessarily increase the performance of the underlying application; it focuses on deployment and configuration consistency.

Answer

Improved auditability.

Answer

Faster recovery from disasters.

Answer

Standardized deployment processes.

Question 4

Which TWO of the following are core principles of GitOps?

Accepted Answer

Declarative desired state.. Declarative state and automated, continuous reconciliation are the foundational pillars of the GitOps methodology.

Answer

Using a GUI for all configuration tasks.

Answer

Use of imperative CLI commands.

Answer

Manual approval for every single sync.

Question 5

Which THREE mechanisms can be used to notify a GitOps controller of a change in Git?

Accepted Answer

Git repository webhooks.. Controllers can detect changes via polling (continuous), webhooks (event-driven), or manual sync requests.

Answer

SSH-based push from the local machine.

Answer

Waiting for a container crash.

Question 6

You are using Argo CD. A developer manually scales a Deployment replica count using 'kubectl scale'. What happens next in a standard GitOps implementation?

Accepted Answer

The controller detects the drift and overwrites the manual change to match Git.. The GitOps controller detects a mismatch between the live state and the Git-defined desired state and automatically reverts it.

Answer

Argo CD sends an alert but does not revert the change.

Answer

The controller updates Git to reflect the new replica count.

Answer

The change persists until the next Git commit.

Question 7

A developer pushes a change to Git, but the cluster does not update. Which log source is most effective for debugging the pull-based mechanism?

Accepted Answer

The logs of the GitOps controller (e.g., Argo CD repo-server or Flux controller).. The controller logs contain information about the reconciliation process, including authentication or parsing errors.

Answer

The browser console of the user.

Answer

The application's logs inside the pod.

Answer

The Git provider's audit logs.

Question 8

When implementing a GitOps workflow with Argo CD, what is the role of the 'AppProject' custom resource?

Accepted Answer

It enforces security boundaries and scope for a set of applications. The AppProject resource acts as a logical grouping for Applications, allowing administrators to restrict where they can be deployed and which resources are permitted, providing multi-tenant security.

Answer

It automatically triggers infrastructure rollbacks upon failure

Answer

It defines the build pipeline for container images

Answer

It stores the Git credentials for the entire cluster

Question 9

A developer updates a Helm release values file in Git to change a ConfigMap key. How does the GitOps pull-based agent determine that reconciliation is necessary?

Accepted Answer

The agent continuously compares the target Git repository commit SHA and state against the cluster's actual state.. The pull-based GitOps agent periodically polls or receives webhooks from the Git repository, comparing the target Git revision (SHA or tag) and contents against the current state stored/deployed in the cluster.

Answer

The container registry notifies the GitOps agent whenever a ConfigMap is altered in the source code.

Answer

The Kubernetes API server continuously queries the Git repository directly without using any controller.

Answer

The agent receives an SSH trigger sent manually by the developer from their workstation.

Question 10

When deploying across multiple clusters using Argo CD, you need to ensure that specific secrets are only available to clusters located in the 'us-east' region. Which resource should you use to enforce this segregation?

Accepted Answer

AppProject. Argo CD AppProject objects are designed specifically to restrict cluster access and namespace access, making them the correct tool for multi-cluster security and segregation.

Answer

ConfigMap

Answer

ApplicationSet

Answer

ClusterRoleBinding

Question 11

When utilizing Git as the 'Source of Truth' for a cluster, what happens if the cluster state diverges from Git?

Accepted Answer

The controller detects the drift and reports it as out-of-sync.. Drift detection allows the GitOps controller to identify when the cluster state has deviated from the declared Git state.

Answer

The controller alerts the administrator but takes no action.

Answer

The Git repository is updated to reflect the new cluster state.

Answer

The cluster ignores the Git repository until a new commit is pushed.

Question 12

When configuring a GitOps tool, what is the purpose of a 'webhook' in relation to the Git repository?

Accepted Answer

To trigger an immediate reconciliation attempt when a push occurs.. Webhooks allow the Git server to notify the GitOps controller that a change has occurred, triggering an immediate sync check.

Answer

To encrypt the traffic between the cluster and Git.

Answer

To replace the need for an SSH key.

Answer

To store the application images.

Question 13

You are implementing GitOps for a legacy application. Why might this be challenging?

Accepted Answer

Legacy applications often lack declarative configuration files.. Legacy applications often lack declarative definitions and might require manual setup steps that are difficult to automate.

Answer

GitOps doesn't support Java applications.

Answer

The cluster API is too slow for legacy apps.

Answer

Git servers cannot store old code.

Question 14

Which TWO are examples of 'Drift' in a GitOps environment?

Accepted Answer

A manual update to a Deployment image via kubectl.. Drift is any change to the cluster state that is not reflected in the Git repository.

Answer

A temporary spike in CPU usage.

Answer

A container crashing due to a code bug.

Answer

A new Git commit.

Question 15

Which TWO of the following are primary benefits of storing the entire desired state of a system in a versioned Git repository?

Accepted Answer

Comprehensive audit trail of all configuration changes. Version control provides a clear audit trail of who changed what, and enables easy restoration to a previous known-good state.

Answer

Automatic hardware repair

Answer

High-availability of the Git server

Answer

Automatic scaling of cluster nodes

Question 16

What is the relationship between the 'desired state' and the 'actual state' in GitOps?

Accepted Answer

The controller continuously reconciles the actual state to the desired state.. The goal of GitOps is to make the actual state equal to the desired state.

Answer

The desired state is defined by the actual state.

Answer

The desired state is enforced by the controller to match the actual state.

Answer

The actual state is manually pushed to the desired state.

Question 17

A senior cloud architect is designing a multi-tenant platform using GitOps. They want to ensure that continuous drift detection and correction operate reliably without causing system instability. Which TWO practices help mitigate risks associated with automated continuous drift correction?

Accepted Answer

Configuring the GitOps controller to ignore specific dynamic fields updated by in-cluster controllers, such as 'spec.replicas' managed by a HorizontalPodAutoscaler (HPA).. Automated drift correction can cause feedback loops or resource exhaustion if external mutations (like auto-scalers modifying replica counts or controllers adding status annotations) conflict with Git. Ignoring dynamic runtime fields or using structured sync windows mitigates these risks.

Answer

Granting full cluster-admin permissions to all application developers so they can manually disable drift correction during deployments.

Answer

Disabling Git versioning so that drift detection compares live state against an unversioned NFS network share.

Answer

Setting the reconciliation loop interval to run once every 30 seconds while forcing a full cluster node reboot on every iteration.

Question 18

Why does GitOps encourage the use of small, frequent commits?

Accepted Answer

To reduce the blast radius and simplify troubleshooting.. Small commits make it easier to identify the cause of failures, simplify rollbacks, and reduce the risk of large-scale outages.

Answer

To force developers to spend more time on documentation.

Answer

To ensure the Git server doesn't crash.

Answer

To minimize the size of the Git repository.

Question 19

Which TWO items are typically included in a GitOps repository?

Accepted Answer

Kustomize overlays or Helm charts.. A GitOps repository contains the declarative definitions of the infrastructure (Kubernetes manifests) and the configuration required to manage them.

Answer

User password lists.

Answer

Database backups.

Answer

Application source code.

Question 20

Which THREE features of Kubernetes are commonly used to support GitOps?

Accepted Answer

The Kubernetes API for resource management.. GitOps relies on the Kubernetes API, Namespaces for isolation, and RBAC to secure the controller's access.

Answer

Node labels for scheduling.

Answer

The cluster's internal clock synchronization.