CGOA Gitops Principles Practice Test 6 — 15 Questions

Question 1

Which TWO scenarios represent 'drift' in a GitOps environment?

Accepted Answer

A developer manually modifies a Service load balancer IP.. Drift in GitOps means the live cluster state diverges from the desired state declared in Git. Option A is correct because manually changing a Service's load balancer IP via kubectl/cloud console alters the running resource outside of Git, so the cluster no longer matches the manifest and the GitOps controller would detect and reconcile that difference. Option B is correct because adding an annotation to a Pod with kubectl is an out-of-band manual mutation of a live object, which is exactly the kind of unauthorized change that constitutes drift. Option C does not represent drift: a valid Pull Request is the normal Git-based change workflow, and once merged the desired state is updated intentionally. Option D is not drift but an operational/connectivity error in the controller. Option E is not drift but successful reconciliation, where the controller brings the cluster into alignment with Git.

Answer

A developer submits a valid Pull Request.

Answer

The controller logs an error about connectivity.

Answer

The GitOps controller successfully updates a deployment.

Question 2

Which THREE of the following are core requirements for adopting a GitOps-based workflow?

Accepted Answer

Declarative infrastructure definitions in Git.. Option A is correct because GitOps requires the desired state of infrastructure and applications to be expressed declaratively (e.g., Kubernetes YAML manifests) and stored in Git as the single source of truth. Option C is correct because a cluster-side agent, such as Argo CD or Flux, continuously reconciles the live cluster state against the declared state in Git. Option E is correct because Git's versioned history provides an auditable, immutable record of every state change, enabling rollbacks and traceability. Option B is incorrect because GitOps is tool-agnostic and does not require proprietary hardware load balancers. Option D is incorrect because GitOps emphasizes automation and continuous reconciliation, reducing the need for manual administrative intervention.

Answer

Proprietary hardware load balancers.

Answer

A full-time manual administrator.

Question 3

Which TWO aspects of GitOps help ensure 'Continuous Drift Detection'?

Accepted Answer

Comparing live state with the desired state in Git.. Option C is correct because Continuous Drift Detection fundamentally relies on continuously comparing the live state of the cluster against the desired state declared in Git, which is the single source of truth in GitOps; any divergence between the two constitutes drift. Option D is correct because this comparison must happen continuously, which is achieved through regular polling of the cluster or event-based monitoring (e.g., Kubernetes controllers, webhooks, or GitOps agents like Argo CD or Flux reconciling on an interval or on change events). Together, C and D describe the mechanism (compare live vs. desired) and the trigger (continuous polling/events) that make drift detection continuous. Option A is incorrect because daily manual audit reports are periodic and human-driven, not continuous or automated. Option B is incorrect because mandating SSH for developers is an access-control practice unrelated to drift detection. Option E is incorrect because storing cluster state in a database is not how GitOps detects drift; the desired state lives in Git, and drift is found by comparing it to the live cluster, not by querying a separate database.

Answer

Daily manual audit reports.

Answer

Forcing all developers to use SSH.

Answer

Using a database to store current cluster state.

Question 4

Which THREE activities are part of the 'Automated Pull-Based Reconciliation' process?

Accepted Answer

Applying updates to the cluster API.. In the Automated Pull-Based Reconciliation process (as used by GitOps tools like Argo CD or Flux), the agent continuously polls the Git repository for changes (D), which is the defining 'pull' behavior that detects new desired state. Once a change is detected, it downloads the updated manifest files (C) from Git to obtain the declared configuration. The agent then applies those updates to the cluster API (A), reconciling the live state with the desired state stored in Git. Option B is incorrect because push notifications to developers are not part of the reconciliation loop — reconciliation is about syncing cluster state, not alerting humans. Option E is incorrect because compiling binaries on the local cluster node is a build/CI activity, not part of pulling and applying manifests during reconciliation.

Answer

Sending a push notification to developers.

Answer

Compiling binaries on the local cluster node.

Question 5

Which THREE of the following are common GitOps tools used in the CNCF ecosystem?

Accepted Answer

Crossplane.. Crossplane (A) is a CNCF project that extends Kubernetes with custom resources to provision and manage cloud infrastructure declaratively, making it a common GitOps tool for infrastructure-as-code workflows. Flux (B) is a CNCF graduated project that continuously reconciles Kubernetes cluster state with Git repositories, embodying the core GitOps pull-based model. Argo CD (D) is also a CNCF graduated project that performs declarative, Git-based continuous delivery for Kubernetes by syncing cluster resources to a desired state stored in Git. Apache HTTP Server (C) is a general-purpose web server and MySQL (E) is a relational database; neither is a GitOps reconciliation or continuous delivery tool, so they do not belong in this list.

Answer

Apache HTTP Server.

Answer

MySQL.

Question 6

Which TWO practices are recommended when managing Git repositories for GitOps?

Accepted Answer

Using directory structures to separate environmental configurations.. Option A is correct because using directory structures to separate environmental configurations (e.g., overlays/dev, overlays/prod or clusters/<env>) keeps each environment's desired state isolated and reviewable, which is a core GitOps practice for promoting changes safely across environments. Option B is correct because structuring manifests logically (grouping by app, namespace, or Kustomize base/overlay) improves readability, maintainability, and code review, making the Git repository a reliable source of truth for GitOps reconciliation. Option C is wrong because hardcoding credentials in manifests exposes secrets in Git history and violates GitOps security practices; secrets should be managed via Sealed Secrets, SOPS, or an external secret store. Option D is wrong because committing direct changes to 'main' bypasses pull-request review and CI validation, undermining the auditable, declarative workflow GitOps depends on. Option E is wrong because storing all environments in a single file couples dev and prod, making it impossible to promote or roll back one environment independently and increasing the blast radius of any change.

Answer

Hardcoding all credentials in the manifest.

Answer

Committing direct changes to the 'main' branch.

Answer

Storing all environments (dev/prod) in a single file.

Question 7

An organization uses Argo CD to manage Kubernetes clusters. A developer manually modifies a Deployment's replica count via kubectl. Which mechanism in Argo CD ensures this manual change is identified as non-compliant with the GitOps repository?

Accepted Answer

Argo CD Application Controller's reconciliation loop. Argo CD's Application Controller runs a continuous reconciliation loop that periodically compares the desired state in Git with the live state in the cluster. When a developer manually changes a Deployment's replica count via kubectl, the controller detects the difference (OutOfSync) and, if auto-sync with self-heal is enabled, reverts the live resource to match Git. This is the core drift-detection mechanism in Argo CD.

Answer

Git repository webhook

Answer

Kubernetes admission controllers

Answer

Kubernetes Garbage Collector

Question 8

You are implementing a GitOps pipeline for a complex microservices architecture. To satisfy the principle of 'versioned and immutable state', how should you handle environment-specific configurations while maintaining a single source of truth?

Accepted Answer

Use Kustomize overlays to manage environment-specific patches stored in the same repository. Kustomize overlays allow you to manage environment-specific configurations as patches stored in the same Git repository, maintaining a single source of truth while avoiding duplication. This aligns with GitOps principles of versioned and immutable state because all configurations are declarative, version-controlled, and can be reviewed. Overlays let you customize base manifests for dev, staging, and prod without branching or separate repos.

Answer

Use a CI pipeline to inject environment variables into the cluster via API calls

Answer

Execute helm install --set commands during the deployment phase

Answer

Maintain separate Git repositories for every environment

Question 9

Which of the following actions best aligns with the GitOps principle of 'Automated Pull-Based Reconciliation'?

Accepted Answer

A cluster-resident controller actively pulling manifests from a Git repository. Automated pull-based reconciliation means a controller running inside the cluster continuously pulls the desired state from Git and reconciles the live state to match, without external push. A cluster-resident controller pulling manifests from Git is the textbook definition of this principle.

Answer

A developer manually running Helm upgrade in the production environment

Answer

Using a Git hook to trigger an SSH deployment script on a remote server

Answer

Jenkins triggers a 'kubectl apply' command to push changes from the CI server

Question 10

Your team is using Flux CD to manage Kubernetes resources. You notice that the application status is 'Suspended'. What is the most likely reason for this state in the context of GitOps principles?

Accepted Answer

A user explicitly set the suspend field to true in the resource manifest. In Flux CD, the 'Suspended' status indicates that the reconciliation of a resource has been manually paused by setting the 'suspend' field to true in the resource manifest (e.g., spec.suspend: true). This is a deliberate action to temporarily halt automated syncs, often for maintenance or debugging. It is not caused by environmental issues like memory or connectivity.

Answer

The cluster is out of memory

Answer

The controller is unable to connect to the container registry

Answer

The Git repository contains syntax errors

Question 11

In a GitOps architecture, why is it critical that the entire state of the system is declarative?

Accepted Answer

To enable the reconciliation loop to calculate the necessary deltas for convergence. A declarative model lets the reconciliation loop compare the desired state (from Git) with the observed live state and compute the specific deltas needed to converge. Without full declarative specification, the controller could not deterministically derive what to create, update, or delete, making automated convergence impossible. Declarative state is the foundation that makes Git the single source of truth.

Answer

To allow for faster manual scaling of pods

Answer

To ensure that Docker images are automatically rebuilt

Answer

To replace the need for RBAC in the Kubernetes cluster

Question 12

Which of the following is considered an 'Anti-pattern' in a GitOps workflow?

Accepted Answer

Applying 'hotfixes' directly to the cluster via kubectl. Applying 'hotfixes' directly to the cluster via kubectl is an anti-pattern in GitOps because it bypasses the declarative, version-controlled workflow. GitOps requires all changes to be made through Git, ensuring auditability, reproducibility, and consistency. Direct kubectl changes cause drift and are not tracked in Git.

Answer

Storing infrastructure definitions as code

Answer

Automated testing of configuration before merging to main

Answer

Using pull requests to review configuration changes

Question 13

When implementing a GitOps workflow with Argo CD, what is the role of the 'AppProject' custom resource?

Accepted Answer

It enforces security boundaries and scope for a set of applications. The AppProject custom resource in Argo CD is a logical grouping of applications that defines security boundaries and scope. It restricts which Git repositories, Kubernetes clusters, and namespaces an application can deploy to, and can enforce RBAC and sync policies. This makes it the primary multi-tenancy and governance mechanism in Argo CD.

Answer

It automatically triggers infrastructure rollbacks upon failure

Answer

It defines the build pipeline for container images

Answer

It stores the Git credentials for the entire cluster

Question 14

Which TWO of the following are primary benefits of storing the entire desired state of a system in a versioned Git repository?

Accepted Answer

Comprehensive audit trail of all configuration changes. Option A is correct because committing the full desired state to Git records every change with author, timestamp, and diff, producing a comprehensive, immutable audit trail of all configuration changes. Option C is correct because Git's commit history lets you check out or revert to any earlier commit, so you can restore a previous known-good desired state quickly and reliably. Options B, D, and E are not benefits of versioning desired state: Git does not perform automatic hardware repair, does not by itself provide high availability of the Git server, and does not automatically scale cluster nodes—those require separate tooling and infrastructure.

Answer

Automatic hardware repair

Answer

High-availability of the Git server

Answer

Automatic scaling of cluster nodes

Question 15

When considering the GitOps principle of 'Declarative Desired State', which TWO of the following statements accurately reflect why manifests should be stored in Git?

Accepted Answer

To serve as the single source of truth for the entire cluster configuration. Option B is correct because storing manifests in Git makes the repository the single source of truth for the entire cluster configuration, so the declarative desired state is versioned, auditable, and can be reconciled by a GitOps operator such as Argo CD or Flux. Option D is correct because Git-based manifests enable peer review and collaboration through Pull Requests, allowing changes to the desired state to be reviewed, approved, and merged before being applied. Option A is incorrect because image pull latency is determined by container registry and node networking, not by where manifests are stored. Option C is incorrect because Git does not automatically encrypt database data; encryption is handled by database or storage-level mechanisms. Option E is incorrect because reconciliation is performed by a GitOps controller running in the cluster, not by the Git server itself.

Answer

To reduce the latency of image pull times

Answer

To automatically encrypt all data in the database

Answer

To allow the Git server to perform the cluster reconciliation