CGOA Gitops Patterns Practice Test 3 — 15 Questions

Question 1

In the context of GitOps, what is 'Configuration Drift'?

Accepted Answer

The difference between the cluster state and the Git repository state.. Configuration drift in GitOps is the divergence between the desired state declared in the Git repository and the actual state running in the cluster. GitOps controllers such as Argo CD or Flux continuously reconcile the cluster toward Git, and drift is detected when the live state no longer matches the declared manifests — for example, after a manual kubectl edit or an out-of-band change.

Answer

A security vulnerability in the container image.

Answer

The movement of traffic between blue and green environments.

Answer

The time taken for a Git commit to reach the production cluster.

Question 2

During a blue-green deployment, what is the primary role of the traffic manager (e.g., Istio or Nginx Ingress)?

Accepted Answer

To split traffic between versions to reduce risk.. In a blue-green deployment, the traffic manager (e.g., Istio, Nginx Ingress) is responsible for routing and splitting traffic between the blue (current) and green (new) versions. This allows controlled exposure of the new version, enabling canary testing or immediate rollback if issues arise, thereby reducing deployment risk. It does not build images, monitor Git, or store logs.

Answer

To build the container image.

Answer

To monitor the Git repository for changes.

Answer

To store application logs.

Question 3

You are designing a multi-cluster deployment with Argo CD. You want to avoid defining 50 individual Application manifests. Which feature should you use?

Accepted Answer

Argo CD ApplicationSets.. Argo CD ApplicationSets use generators (cluster, Git, list, matrix) to template and produce many Applications from a single manifest, so you avoid writing 50 individual Application resources. A cluster generator can automatically create one Application per registered cluster, which is exactly the multi-cluster scaling need. This is the idiomatic Argo CD feature for fleet-wide deployments.

Answer

Helm subcharts.

Answer

Git submodules.

Answer

Kubernetes Custom Resource Definitions (CRDs).

Question 4

What does the 'prune' policy in GitOps do?

Accepted Answer

It deletes resources from the cluster that are no longer in Git.. The prune policy in GitOps deletes resources from the cluster that are no longer present in Git, ensuring the cluster state matches the declared desired state exactly. Without pruning, removed manifests would leave orphaned resources running, causing drift between Git and the live cluster.

Answer

It cleans up old container logs.

Answer

It synchronizes the Git repo with the latest upstream changes.

Answer

It restarts pods that have been running for too long.

Question 5

You want to use Helm for your GitOps deployments. Where should the 'values.yaml' file reside for environment-specific overrides?

Accepted Answer

In the Git repository, per environment.. Environment-specific values.yaml overrides must live in Git, organized per environment (e.g., envs/dev/values.yaml, envs/prod/values.yaml), so the GitOps operator can render the chart with the correct values for each target cluster. This keeps Git as the single source of truth and makes environment differences reviewable and auditable.

Answer

In a local machine folder not tracked by Git.

Answer

In the Argo CD global settings.

Answer

Inside the container image.

Question 6

In a GitOps promotion pipeline, why is it recommended to tag container images with a unique Git commit SHA instead of 'latest'?

Accepted Answer

To ensure immutability and auditability.. Tagging container images with a unique Git commit SHA ensures immutability because the tag directly corresponds to a specific commit, making it easy to trace back to the exact source code. This provides auditability, as you can always identify which code version is running. Using 'latest' is mutable and can lead to inconsistent deployments.

Answer

Because the container registry requires unique SHAs.

Answer

To reduce the size of the container image.

Answer

Because 'latest' is deprecated by Docker.

Question 7

When using Argo CD, how do you handle applications that require resources to be created in a specific order (e.g., CRDs before Operators)?

Accepted Answer

Use syncWaves annotations.. Argo CD supports sync waves via the argocd.argoproj.io/sync-wave annotation, which lets you assign an integer wave number to each resource. Argo CD applies resources in ascending wave order, waiting for each wave to become healthy before proceeding to the next. This is the canonical way to ensure CRDs are applied before the Operators or custom resources that depend on them.

Answer

Use multiple Git repositories.

Answer

Disable automated sync and run it twice.

Answer

Use a single massive YAML file.

Question 8

What is the primary function of an 'ApplicationSet' in Argo CD?

Accepted Answer

To automate the creation of Argo CD Applications.. An ApplicationSet in Argo CD is a controller that automates the generation of Argo CD Applications from a template plus a generator (such as a Git directory, cluster list, or pull request generator). It allows one ApplicationSet manifest to produce many Applications, which is essential for multi-cluster and multi-tenant GitOps at scale.

Answer

To perform unit testing on manifests.

Answer

To manage cluster security policies.

Answer

To automatically update the Git repo with new commits.

Question 9

You are using a 'Pull' based GitOps model (e.g., Flux or Argo CD). Why is it considered more secure than a 'Push' based CI/CD model?

Accepted Answer

It eliminates the need for cluster credentials on the CI server.. In a Pull-based GitOps model, the agent (Flux or Argo CD) runs inside the target cluster and pulls the desired state from Git. The CI system never needs kubeconfig credentials or cluster-admin tokens to push manifests, so a compromise of the CI pipeline cannot be used to directly mutate the cluster. This removes the most dangerous credential exposure path in traditional push-based pipelines.

Answer

It allows faster deployment times.

Answer

It does not require a container registry.

Answer

It is easier to configure with SSH keys.

Question 10

What happens if the 'revision' in an Argo CD Application points to a branch that does not exist?

Accepted Answer

The application will be marked as 'Invalid' or 'Degraded'.. If the revision points to a non-existent branch, Argo CD cannot resolve the desired state, so the Application's sync status becomes Unknown/Invalid and health may show Degraded or Missing. It does not fall back to another branch or create one. The controller continues running; only that Application is affected.

Answer

It will create the branch automatically.

Answer

It will stop the Argo CD controller.

Answer

It will sync the 'main' branch instead.

Question 11

In GitOps, what is the 'Source of Truth'?

Accepted Answer

The Git repository.. In GitOps, the Git repository is the single source of truth because it holds the declarative manifests that define the desired state of the entire system. All changes originate as commits, and the GitOps agent continuously reconciles the live cluster to match what is declared in Git. This makes Git the authoritative record, not the running cluster.

Answer

The running Kubernetes cluster.

Answer

The CI pipeline logs.

Answer

The container registry.

Question 12

Why would you choose to use 'Kustomize' over 'Helm' in a GitOps workflow?

Accepted Answer

Because it avoids complex templating logic.. Kustomize uses a declarative overlay model with patches and bases rather than a templating language, which avoids the complex logic, conditionals, and whitespace pitfalls of Helm templates. This makes manifests easier to read, review, and validate in a GitOps workflow where the rendered output should be predictable.

Answer

Because Kustomize is the only tool Argo CD supports.

Answer

Because it supports more advanced logic than Helm.

Answer

Because Kustomize requires a server-side component.

Question 13

When setting up a multi-cluster GitOps pattern, what is the benefit of using 'Cluster Labels' in ApplicationSets?

Accepted Answer

It allows dynamic targeting of clusters based on attributes.. Cluster Labels in ApplicationSets allow you to select target clusters based on label selectors. This enables dynamic generation of Applications for clusters that match specific attributes, such as environment, region, or team, without hardcoding cluster names.

Answer

It increases the speed of the Git clone.

Answer

It reduces the number of namespaces required.

Answer

It encrypts the communication between clusters.

Question 14

When managing multiple environments (dev/stage/prod) in one repository, which folder structure is generally considered best practice?

Accepted Answer

Using environment-specific folders.. Environment-specific folders (e.g., /dev, /stage, /prod) keep manifests for each environment isolated while sharing a single repository, enabling consistent promotion workflows and clear ownership. This structure lets GitOps tools like Argo CD or Flux target a specific path per environment without duplicating the entire repo. It also makes diffs between environments obvious and supports per-environment overlays (Kustomize) or values files (Helm).

Answer

Storing configurations in the application code folder.

Answer

Putting everything in a single root folder.

Answer

Using different Git repos for every single manifest.

Question 15

You are using Argo Rollouts for progressive delivery. You want to execute a 'AnalysisRun' before switching traffic. Where is the 'AnalysisTemplate' defined?

Accepted Answer

As a Kubernetes resource in Git.. An AnalysisTemplate is a Kubernetes custom resource (CRD) that defines how to query a metric provider (Prometheus, Datadog, etc.) and what thresholds constitute success or failure. Like all GitOps artifacts, it must be declared as a Kubernetes resource stored in Git so the operator can create AnalysisRuns from it during a rollout.

Answer

In the Argo CD global configuration file.

Answer

Hardcoded in the application binary.

Answer

By the Service Mesh control plane directly.