CGOA Practice Test 5 — 25 Questions

Question 1

Which tool provides the most native integration for managing Kubernetes manifests using Kustomize within a GitOps workflow?

Accepted Answer

Argo CD. Argo CD has native, first-class support for Kustomize overlays, allowing for environment-specific customization without needing external tools.

Answer

Terraform

Answer

Ansible

Answer

Jenkins

Question 2

An organization uses Argo CD to manage Kubernetes clusters. A developer manually modifies a Deployment's replica count via kubectl. Which mechanism in Argo CD ensures this manual change is identified as non-compliant with the GitOps repository?

Accepted Answer

Argo CD Application Controller's reconciliation loop. Argo CD continuously compares the live state of the cluster with the desired state defined in Git. When a discrepancy is detected, it reports the status as 'OutOfSync', performing drift detection.

Answer

Git repository webhook

Answer

Kubernetes admission controllers

Answer

Kubernetes Garbage Collector

Question 3

A DevOps team is storing its Kubernetes manifests in a Git repository. To adhere strictly to the principle of versioned and immutable desired state in Git, how should the team manage changes to an existing deployment's container image tag?

Accepted Answer

Commit a change updating the image tag in the manifest file within the Git repository and merge it via a pull request.. GitOps principles require that the desired state stored in Git is versioned and immutable. Modifying the manifest in Git via a new commit or pull request creates a traceable, versioned audit trail. Directly mutating live cluster resources using kubectl violates the single source of truth principle.

Answer

Exec into the running pod using 'kubectl exec' and update the container image binary directly.

Answer

Run 'kubectl set image deployment/my-app my-app=image:v2' against the live cluster without updating Git.

Answer

Delete the deployment using 'kubectl delete' and manually re-apply a temporary local manifest file.

Question 4

Why is 'Git' considered the 'source of truth' in GitOps?

Accepted Answer

Because it acts as the single point of record for the desired system state.. Git provides a clear, immutable, and auditable history of every change made to the system, which is essential for reproducibility.

Answer

Because Git stores all application logs.

Answer

Because it is the only tool that supports branching.

Answer

Because Git automatically runs the applications.

Question 5

An administrator notices that an engineer manually modified a Service loadBalancerIP in the Kubernetes live cluster using 'kubectl edit'. The cluster is managed by an automated GitOps engine configured in a pull-based model. What will happen during the next reconciliation cycle?

Accepted Answer

The GitOps engine will detect the drift and overwrite the live cluster state to match the declared state in Git.. In a pull-based GitOps pattern, an agent running inside the cluster continuously monitors both the declared state in Git and the actual state in the cluster. When drift is detected, the controller overwrites the live state with the desired state defined in Git.

Answer

The GitOps engine will automatically commit the updated loadBalancerIP back to the Git repository to keep Git in sync.

Answer

The live cluster modification will block future Git commits from being fetched by the GitOps agent.

Answer

The GitOps engine will halt reconciliation permanently until an administrator manually clears the cluster error log.

Question 6

Your team is using Flux CD to manage Kubernetes resources. You notice that the application status is 'Suspended'. What is the most likely reason for this state in the context of GitOps principles?

Accepted Answer

A user explicitly set the suspend field to true in the resource manifest. Suspending a Kustomization or HelmRelease in Flux stops the reconciliation process, meaning the controller will no longer apply changes from Git to the cluster.

Answer

The cluster is out of memory

Answer

The controller is unable to connect to the container registry

Answer

The Git repository contains syntax errors

Question 7

A platform engineer wants to configure an application state declaratively. They write an imperative script containing commands like 'kubectl scale deployment --replicas=5' and push this script into a Git repository for execution by a cron job. Why does this approach fail to satisfy the core GitOps principle of 'Declarative Desired State'?

Accepted Answer

The state is defined as a series of execution steps rather than a static description of the target system configuration.. Imperative scripts define 'how' to achieve a state through a sequence of steps, rather than expressing 'what' the target system should look like (declarative). Declarative state relies on static configuration documents (like YAML manifests) that express target end-states.

Answer

GitOps tools only support JSON files and reject any YAML or shell-based configurations.

Answer

Cron jobs running in Kubernetes cannot execute kubectl commands against the internal API server.

Answer

Imperative scripts cannot be stored in Git repositories due to file permission limitations.

Question 8

When setting up Argo CD, which TWO components are essential to define a GitOps workflow?

Accepted Answer

AppProject. An Application object defines the source and destination, and a Project organizes them.

Answer

Kubernetes Node

Answer

Docker Registry

Answer

Jenkins Pipeline

Question 9

Which of the following is considered an 'Anti-pattern' in a GitOps workflow?

Accepted Answer

Applying 'hotfixes' directly to the cluster via kubectl. GitOps requires that the Git repository is the sole source of truth; any manual 'hotfixing' via kubectl overrides the versioned state and creates drift.

Answer

Storing infrastructure definitions as code

Answer

Automated testing of configuration before merging to main

Answer

Using pull requests to review configuration changes

Question 10

During an audit, an organization discovers that a secret was accidentally committed to a Git repository managed by Flux. An engineer deletes the commit containing the secret using 'git push --force' with a rewritten history. Why is this action problematic in a production GitOps environment?

Accepted Answer

Force-pushing history breaks the cryptographic chain of custody and can desynchronize agents expecting immutable, append-only history.. Rewriting Git history invalidates the audit log and can cause synchronization issues or unexpected behaviors across distributed reconcilers that rely on immutable commit SHAs. In GitOps, secrets should be removed properly (e.g., using secret management tools like Sealed Secrets or SOPS) and rotated immediately rather than altering historical commits.

Answer

Kubernetes secrets created before the force-push are automatically converted into ConfigMaps by the API server.

Answer

Flux automatically restores deleted Git commits by fetching missing objects from the live cluster memory.

Answer

Git repositories permanently reject future commits if a force-push is detected by the GitOps operator.

Question 11

A team is reviewing their deployment practices against OpenGitOps standards. Which THREE conditions are required to satisfy the 'Declarative Desired State' and 'Versioned and Immutable State' principles?

Accepted Answer

The target system's desired state is expressed in a software-interpretable, declarative format like YAML or JSON.. OpenGitOps principles state that desired state must be expressed declaratively, stored in a system that enforces versioning and immutability (like Git), and serve as the single source of truth.

Answer

Live cluster state is permitted to override repository configurations during peak traffic periods.

Answer

System changes are made by executing manual shell scripts directly on production control plane nodes.

Question 12

When implementing a CI/CD pipeline for GitOps, how should you handle image tag updates?

Accepted Answer

Using an automated agent that detects new images and commits the tag change back to the Git repo.. Automating image updates through a tool like Renovate or Argo CD Image Updater ensures the repository is kept in sync with the latest build artifacts.

Answer

Having the CD operator pull the 'latest' tag directly from the registry.

Answer

Manually updating the YAML file with the new image tag and committing to Git.

Answer

Triggering a shell script to update the cluster state directly from the CI pipeline.

Question 13

In a GitOps environment, what is the best strategy for managing external dependencies (like Helm charts)?

Accepted Answer

Pinning the version of the Helm chart in your Git repository.. Storing the specific version of the Helm chart in the GitOps configuration ensures that the deployment remains reproducible.

Answer

Always pulling the latest version from the remote Helm repository.

Answer

Ignoring the chart version and hoping it stays compatible.

Answer

Manually downloading the chart to every node.

Question 14

Your organization uses a 'GitOps Operator' to manage deployments. What happens if a developer manually changes a configuration on the Kubernetes cluster using 'kubectl edit'?

Accepted Answer

The GitOps operator will detect the drift and revert the manual change to match the configuration in Git.. The GitOps operator continuously monitors the cluster state against the Git repository; it will detect the 'out-of-sync' status and overwrite the manual change to restore the desired state.

Answer

The GitOps operator will enter a 'halt' state and require manual intervention to synchronize.

Answer

The GitOps operator will trigger an alert, but the manual change will remain in place until the next deployment.

Answer

The GitOps operator will automatically update the Git repository to reflect the manual change.

Question 15

What is a 'GitOps Operator'?

Accepted Answer

A controller that continuously reconciles Git with cluster state. An operator is a Kubernetes controller that continuously reconciles the cluster state with a source of truth in a Git repository.

Answer

A human user who manages Git

Answer

A CI/CD pipeline server

Answer

A Git server provider

Question 16

Which TWO of the following are true about ArgoCD ApplicationSets?

Accepted Answer

They support multi-cluster generators. ApplicationSets automate the generation of applications and support multi-cluster deployment via generators.

Answer

They are only for local clusters

Answer

They handle container image builds

Answer

They replace the need for Git

Question 17

You are auditing a GitOps process. Which of the following is an indicator that the process is NOT truly following GitOps principles?

Accepted Answer

An administrator manually updates a Kubernetes Deployment manifest directly on the cluster.. If a developer manually modifies a resource using kubectl, they are bypassing the Git source of truth, which is the definition of a GitOps violation.

Answer

Secrets are encrypted in the Git repo.

Answer

The cluster automatically reconciles changes pushed to Git.

Answer

Developers use PRs to propose changes to the environment.

Question 18

What is the primary role of the GitOps operator during the reconciliation phase?

Accepted Answer

Continuously checking if the cluster matches the desired state in Git.. The operator compares the actual state of the cluster with the desired state in Git and makes adjustments to match them.

Answer

Reporting the number of users connected to the cluster.

Answer

Deleting the Git repository to save space.

Answer

Compiling the application source code.

Question 19

Which THREE items should be included in your Git repository for a standard GitOps setup?

Accepted Answer

Policy-as-Code files (e.g., OPA policies).. A GitOps repository should contain the declarative manifests, template files (like Helm/Kustomize), and security policies.

Answer

Application source code files.

Answer

The private keys for the production cluster.

Question 20

How does the GitOps pattern simplify the audit process for a regulatory environment?

Accepted Answer

It provides a clear audit trail in Git by linking every state change to a commit and a user.. Git history provides an immutable log of who changed what and when, serving as a complete audit trail for compliance teams.

Answer

It moves all audit logs to the cluster memory.

Answer

It requires manual documentation of every change.

Answer

It removes the need for logs.