CGOA Practice Test 5 — 10 Questions

Question 1

When using Argo CD, what does the 'Sync Status' 'OutOfSync' indicate?

Accepted Answer

The live state differs from the desired state in Git.. In Argo CD, 'OutOfSync' means the live Kubernetes cluster state does not match the desired state declared in the Git repository. Argo CD continuously compares the manifests in Git against the resources running in the cluster, and any difference (missing resource, changed field, extra resource) sets the Sync Status to OutOfSync. This is distinct from Health Status, which reflects whether resources are functioning correctly.

Answer

The cluster is disconnected from the network.

Answer

A new version of the application is available in the registry.

Answer

The Git repository has been deleted.

Question 2

Why is 'pull-based' reconciliation considered more secure than 'push-based' CI/CD?

Accepted Answer

Because the cluster initiates the connection.. In a pull-based model, an in-cluster agent (Argo CD, Flux) initiates outbound connections to Git and the registry, so no external system needs inbound access or cluster-admin credentials. This inverts the trust boundary: the cluster reaches out rather than an external CI server reaching in. That architectural inversion is what makes pull-based reconciliation more secure.

Answer

Because it eliminates the need for Git.

Answer

Because Git requires passwords for every pull.

Answer

Because it removes the need for container images.

Question 3

When using an 'Image Updater' with a GitOps operator, what is the automated workflow?

Accepted Answer

It detects new images and updates the manifest in Git. An Image Updater (such as Argo CD Image Updater) monitors a container registry for new image tags and, when it detects a newer version matching the configured policy, writes the updated image tag back into the Git manifest. This keeps Git as the source of truth while automating image version bumps. The GitOps operator then syncs the updated manifest to the cluster.

Answer

It manually restarts the cluster

Answer

It creates a backup of the cluster

Answer

It bypasses the git repository entirely

Question 4

In a GitOps environment, what is the role of a 'CI Pipeline'?

Accepted Answer

To validate changes and commit them to the GitOps repo. In GitOps, the CI pipeline's job is to build, test, and validate changes, then commit the resulting manifests (or updated image tags) into the GitOps repository. The GitOps operator (e.g., Argo CD or Flux) then detects the commit and reconciles the cluster to match. CI produces the desired state; the GitOps controller applies it.

Answer

To replace the GitOps operator

Answer

To execute the reconciliation loop

Answer

To handle user authentication for the cluster

Question 5

Which tool provides the most native integration for managing Kubernetes manifests using Kustomize within a GitOps workflow?

Accepted Answer

Argo CD. Argo CD is purpose-built for GitOps and natively supports Kustomize as a first-class manifest source. Its repository server recognizes kustomization.yaml files and can render Kustomize overlays directly without external tooling. Terraform, Ansible, and Jenkins are general-purpose automation tools that require custom glue code to invoke Kustomize and do not provide continuous reconciliation of Kustomize-rendered manifests.

Answer

Terraform

Answer

Ansible

Answer

Jenkins

Question 6

What is the primary advantage of storing Kubernetes manifests in a version-controlled repository?

Accepted Answer

It provides a backup in case the cluster is deleted.. Storing Kubernetes manifests in a version-controlled repository (e.g., Git) creates a durable, auditable record of the desired cluster state. If the cluster is deleted or corrupted, the manifests can be re-applied to rebuild the environment, effectively acting as a backup of the declarative configuration. This is a core GitOps principle: Git is the single source of truth for both application and infrastructure definitions.

Answer

It makes the container images run faster.

Answer

It automatically patches security vulnerabilities.

Answer

It allows developers to bypass the CI/CD system.

Question 7

You have a GitOps pipeline where you want to promote a change from Staging to Production. Using Argo CD, what is the recommended way to perform this promotion?

Accepted Answer

Update the version in the Git manifest for the Production Application and commit.. In a GitOps model, Git is the single source of truth, so promotion between environments must be performed by changing the desired state in Git, not by imperative commands. Updating the version in the Production Application's manifest and committing it lets Argo CD detect the drift and reconcile the cluster to match. This preserves auditability, rollback via Git revert, and declarative consistency.

Answer

Update the ApplicationSet generator to point to a different branch.

Answer

Run 'argocd app sync' pointing to the staging image.

Answer

Use the 'kubectl patch' command on the production deployment.

Question 8

Which of these is a primary reason for using Helm charts in a GitOps workflow?

Accepted Answer

Templating and packaging complex applications. Helm charts are used in GitOps workflows primarily for templating and packaging complex applications (D). Helm allows you to define Kubernetes resources as parameterized templates, making it easy to manage and version application configurations in Git. This aligns with GitOps principles where the desired state is stored declaratively in Git and applied automatically.

Answer

Encrypting all traffic

Answer

Replacing the need for Kubernetes

Answer

Creating Git commits automatically

Question 9

In an Argo CD deployment, a developer notices that manual changes made via kubectl are being reverted automatically. What feature is responsible for this behavior?

Accepted Answer

Auto-Sync with Self-Heal enabled. Argo CD's Auto-Sync with Self-Heal enabled continuously compares the live cluster state against the desired state in Git and automatically reverts any drift. When a developer makes a manual kubectl change, the Application Controller detects the difference during its reconciliation loop and re-applies the Git-defined manifest, effectively undoing the manual change. Self-Heal is the specific sub-feature of automated sync that enforces this drift correction.

Answer

Git commit hook triggers

Answer

Kubernetes admission controllers

Answer

Manual refresh button

Question 10

A company transitions from a push-based CI/CD pipeline (using Jenkins) to a pull-based GitOps model (using Flux). What is the primary security architectural change regarding cluster access?

Accepted Answer

The CI server no longer requires cluster credentials. In a pull-based GitOps model, the in-cluster operator (Flux) pulls desired state from Git and applies it from inside the cluster. The CI server's only job is to build and push artifacts and commit manifest changes to Git — it never needs kubeconfig or cluster API credentials. This removes the long-lived cluster credentials that a push-based Jenkins pipeline required to run kubectl/helm against the cluster.

Answer

Git is no longer the source of truth

Answer

The cluster no longer requires an API server

Answer

The operator is now a push-based agent