CGOA Gitops Principles — Timed 40 Questions

Question 1

What happens when you delete an application from the Argo CD dashboard without deleting the Git repository?

Accepted Answer

The controller re-syncs and restores the application.. Argo CD continuously monitors the desired state defined in Git and the live state in the cluster. When you delete an Application resource from the Argo CD dashboard, you are only removing the Argo CD Application object (the tracking resource), not the Git repository or the cluster resources. If the Application was part of an App of Apps pattern or if the controller still has a reference to it (e.g., via a parent Application), the controller will detect the missing Application and re-create it, triggering a sync that restores the application. In most standard setups, deleting the Application from the dashboard does not delete the Git repo, so the controller will re-sync and restore the application if it is still managed by a parent Application or if the deletion is not cascading. The correct answer reflects that the controller re-syncs and restores the application.

Answer

The Git repository is automatically updated.

Answer

The cluster is wiped completely.

Answer

Nothing happens.

Question 2

A team wants to ensure that all infrastructure modifications are peer-reviewed and auditable. Which GitOps principle best describes the practice of requiring a Pull Request for every change to the cluster state?

Accepted Answer

Versioned and immutable state stored in Git. The versioned and immutable state principle ensures all changes are traceable and verifiable through Git history.

Answer

Automated reconciliation

Answer

Continuous drift detection

Answer

Declarative desired state

Question 3

A platform team maintains a GitOps repository containing HelmRelease and Kustomization manifests for a production cluster managed by Flux. A developer needs to change an application's replica count for a canary test, but the change must not affect the stable release and must be quickly revertible. Which GitOps practice best satisfies these requirements while preserving the declarative, version-controlled desired state?

Accepted Answer

Create a separate overlay or branch for the canary environment, commit the replica change there, and let Flux reconcile that overlay or branch.. The GitOps principle of declarative desired state stored in Git means any environment-specific change, including a canary replica count, should be represented as a version-controlled manifest. A separate overlay or branch lets Flux reconcile only that scope, keeping the stable release untouched and making the canary change instantly revertible via Git history.

Answer

Edit the Deployment directly with kubectl scale and later reconcile by reverting the change in Git.

Answer

Add an imperative script to the CI pipeline that runs kubectl scale only during the canary window.

Answer

Commit the replica change to a short-lived branch, open a pull request, and merge it only after the canary test completes.

Question 4

An organization uses Argo CD for GitOps. They want to ensure that their production environment is protected from accidental changes. They decide that any change to production must be reviewed and approved via a pull request before being merged to the main branch, and that Argo CD should automatically sync the changes. Which GitOps principle does this workflow primarily demonstrate?

Accepted Answer

Automated reconciliation. The workflow of reviewing changes via pull request and then having Argo CD automatically sync them demonstrates automated reconciliation. The agent continuously monitors Git and applies changes, ensuring the live state matches the desired state. While other principles like Git as the single source of truth and pull-based deployment are also present, the key behavior is the automatic syncing after merge.

Answer

Pull-based deployment

Answer

Git as the single source of truth

Answer

Declarative configuration

Question 5

Which TWO of the following are primary benefits of storing immutable state in Git?

Accepted Answer

Reduction in manual cluster configuration errors. Option A is correct because storing immutable state in Git (the GitOps model) makes the desired cluster configuration declarative and version-controlled, so changes are reviewed and applied consistently, which reduces manual, error-prone cluster configuration. Option D is correct because every change to the desired state is a Git commit, giving a complete, auditable history of who changed what and when, enabling rollback and traceability of all environment changes. Option B is not a primary benefit of immutable Git state, since hotfix speed depends on the CI/CD pipeline and deployment process, not on storing state in Git. Option C is incorrect because Git does not automatically convert Docker images into YAML manifests; that requires separate tooling. Option E is incorrect because Git stores configuration, not server storage capacity, so it does not increase server-side storage.

Answer

Faster deployment of hotfixes directly to production

Answer

Automated conversion of Docker images to YAML

Answer

Increased server-side storage capacity

Question 6

You are implementing a GitOps workflow where the desired state is stored in a private repository. The Argo CD controller requires access to this repository. What is the most secure GitOps-compliant way to provide this access?

Accepted Answer

Create a Kubernetes Secret containing the SSH key and reference it in the repository configuration.. Storing the SSH private key in a Kubernetes Secret and referencing it in Argo CD's repository configuration is the GitOps-compliant and secure approach. Secrets are the native Kubernetes mechanism for sensitive data, can be encrypted at rest (with KMS or sealed-secrets), and are scoped to the Argo CD namespace with RBAC controls. This keeps credentials out of Git and out of plaintext manifests, aligning with GitOps principles of declarative, auditable, and secure state management.

Answer

Grant the cluster node broad read access to all public repositories.

Answer

Use an environment variable in the Argo CD container deployment manifest.

Answer

Hardcode the credentials in the Application manifest.

Question 7

In an Argo CD deployment, a developer notices that manual changes made via kubectl are being reverted automatically. What feature is responsible for this behavior?

Accepted Answer

Auto-Sync with Self-Heal enabled. Argo CD's Auto-Sync with Self-Heal enabled continuously compares the live cluster state against the desired state in Git and automatically reverts any drift. When a developer makes a manual kubectl change, the Application Controller detects the difference during its reconciliation loop and re-applies the Git-defined manifest, effectively undoing the manual change. Self-Heal is the specific sub-feature of automated sync that enforces this drift correction.

Answer

Git commit hook triggers

Answer

Kubernetes admission controllers

Answer

Manual refresh button

Question 8

Your team is using a pull-based GitOps pattern. Which component is responsible for initiating the communication to the Git repository to check for updates?

Accepted Answer

The agent running inside the Kubernetes cluster.. In a pull-based GitOps model, an agent (such as Argo CD or Flux) runs inside the Kubernetes cluster and periodically polls the Git repository to detect desired-state changes. The agent initiates the outbound connection to Git, then reconciles the cluster state to match what is declared in the repository. This pull model keeps cluster credentials out of the CI system and gives the cluster control over when updates are applied.

Answer

The developer's local kubectl client.

Answer

The CI/CD pipeline pushes updates to the cluster.

Answer

The Git server pushes changes to the cluster webhook.

Question 9

An organization is migrating to GitOps using Argo CD. During an audit, you notice that manual changes made directly to the Kubernetes cluster via kubectl are being reverted within minutes. Which component of the GitOps pipeline is performing this action?

Accepted Answer

The Application Controller. The Argo CD Application Controller is the component that continuously monitors live cluster state against the desired state in Git and performs reconciliation. When it detects drift (e.g., a manual kubectl change), and the Application has automated sync with self-heal enabled, the Application Controller re-applies the Git-defined manifests, reverting the manual change. It is the engine behind Argo CD's drift correction.

Answer

The cluster ingress controller

Answer

The Argo CD API server

Answer

The Git webhook listener

Question 10

In a GitOps environment, an engineer manually deletes a Deployment via 'kubectl'. What should happen next to maintain the desired state?

Accepted Answer

The controller detects the drift and automatically restores the Deployment.. In a GitOps environment, the GitOps controller continuously reconciles the actual state of the cluster with the desired state stored in Git. When a Deployment is manually deleted, the controller detects the drift and automatically recreates it to match the Git manifest. This self-healing behavior is a core principle of GitOps.

Answer

The controller ignores the change until the next git commit.

Answer

The system issues an alert but does not modify the cluster.

Answer

The manual deletion is permanently synced to the Git repository.

Question 11

Which THREE principles are foundational to the GitOps model as defined by the CNCF GitOps Working Group?

Accepted Answer

Changes must be automatically pulled and applied. Option C is correct because GitOps requires an automated agent (such as Argo CD or Flux) that continuously pulls the desired state from Git and reconciles it into the cluster, rather than relying on external push-based deployments. Option D is correct because the CNCF GitOps Working Group defines the desired state as versioned and immutable, with Git serving as the single source of truth whose history is preserved. Option E is correct because the entire system must be described declaratively (for example, Kubernetes YAML manifests) so the agent can compare desired versus actual state and converge them. Option A is incorrect because GitOps favors automated reconciliation, not mandatory manual approval for every production deployment. Option B is incorrect because GitOps is fundamentally pull-based, not push-based, so push-based CI/CD pipelines contradict the model.

Answer

Manual approval is required for all production deployments

Answer

Software must be delivered using push-based CI/CD pipelines

Question 12

A team is transitioning to GitOps. Which action best aligns with the principle of Declarative Desired State?

Accepted Answer

Storing YAML manifests in Git representing the target environment state. Declarative desired state in GitOps means the target environment state is expressed as declarative manifests (for example, Kubernetes YAML) stored in Git as the single source of truth. A controller then reconciles the live environment to match that declared state, which is exactly what storing YAML manifests in Git represents.

Answer

Running a pipeline to execute terraform apply on demand

Answer

Writing a bash script to update image tags on all clusters

Answer

Using kubectl edit to modify running pod replicas

Question 13

In the context of GitOps, what is meant by 'Pull-based' architecture?

Accepted Answer

The cluster agent proactively pulls configurations from the repository.. In a pull-based GitOps architecture, an agent running inside the cluster (such as Argo CD or Flux) continuously monitors the Git repository for changes and pulls the desired state, applying it to the cluster. This is in contrast to push-based models where external systems push changes into the cluster. The cluster agent proactively pulls configurations, ensuring the cluster state converges to the declared state in Git.

Answer

The repository pulls changes from the cluster.

Answer

The cluster is pulled into the development network.

Answer

Developers push code to the cluster API.

Answer

External systems pull logs from the cluster.

Question 14

What is the primary role of an 'Immutable' state in a GitOps repository?

Accepted Answer

To ensure that historical configurations can be reliably rolled back.. In GitOps, an immutable repository state means that once a configuration is committed, it is never modified in place — changes are made by creating new commits. This immutability provides a reliable audit trail and ensures that any historical configuration can be deterministically rolled back by checking out a previous commit. It is a core principle that enables reproducibility and disaster recovery in GitOps workflows.

Answer

To increase the storage capacity of the cluster.

Answer

To allow the cluster to delete resources at will.

Answer

To force developers to use a specific IDE.

Question 15

When utilizing Git as the 'Source of Truth' for a cluster, what happens if the cluster state diverges from Git?

Accepted Answer

The controller detects the drift and reports it as out-of-sync.. In GitOps, Git is the single source of truth, and the reconciliation controller continuously compares the live cluster state against the desired state in Git. When they diverge, the controller marks the Application as OutOfSync and, depending on sync policy, may auto-heal or wait for manual sync. It never silently overwrites Git with cluster state, preserving Git's authority.

Answer

The controller alerts the administrator but takes no action.

Answer

The Git repository is updated to reflect the new cluster state.

Answer

The cluster ignores the Git repository until a new commit is pushed.

Question 16

An application is failing because a developer accidentally edited a ConfigMap in the cluster directly. Which GitOps feature prevents this from recurring?

Accepted Answer

Continuous reconciliation.. Continuous reconciliation is the GitOps mechanism where an agent (Argo CD, Flux) running in the cluster continuously compares the live state against the desired state declared in Git and automatically reverts any drift. If a developer manually edits a ConfigMap, the reconciler detects the divergence on its next sync cycle and restores the Git-declared value, preventing the manual change from persisting. This is the defining GitOps control that enforces Git as the single source of truth and eliminates configuration drift.

Answer

Role-Based Access Control (RBAC).

Answer

External DNS.

Answer

CI/CD pipeline triggers.

Question 17

You need to ensure that no one can modify cluster resources manually. How can you implement this in a GitOps-mature organization?

Accepted Answer

Remove cluster-admin access from all users except the GitOps controller.. In a GitOps-mature organization, the GitOps controller is the only entity with write access to the cluster, and all changes flow through Git. Removing cluster-admin access from all users except the GitOps controller enforces this by preventing manual modifications, ensuring that the Git repository remains the single source of truth. This is a foundational security practice in GitOps.

Answer

Install a plugin that logs all kubectl commands.

Answer

Add a firewall rule to block kubectl.

Answer

Disable the Kubernetes API server.

Question 18

Which of the following best describes the 'Declarative' principle in GitOps?

Accepted Answer

Defining the target state in configuration files.. Declarative means you describe the desired end state in version-controlled configuration files (YAML/JSON/HCL), and a controller continuously reconciles reality to match it. You declare 'what' the system should look like, not 'how' to get there step by step. This is the foundation that makes Git the single source of truth in GitOps.

Answer

Using an interactive terminal to manage resources.

Answer

Providing a script to update resources.

Answer

Requiring manual approval for every reconciliation.

Question 19

Your organization requires an audit trail of all changes to infrastructure. Why is GitOps superior to imperative 'kubectl' commands for this?

Accepted Answer

Git provides a permanent, immutable, and auditable history of who made what change and when.. GitOps uses Git as the single source of truth, so every change is a commit with author, timestamp, and diff. This creates a permanent, immutable, and auditable history of who changed what and when, which imperative kubectl commands do not provide.

Answer

Kubectl allows editing the live state without record.

Answer

Git is faster than kubectl for large clusters.

Answer

The cluster automatically emails admins when kubectl is used.

Question 20

When syncing a Git repository to a cluster, what is the 'Sync Policy' in Argo CD?

Accepted Answer

It defines whether the application should be synced automatically or manually.. The Sync Policy in Argo CD controls whether the application is synchronized automatically when Git changes are detected, or only when a user manually triggers a sync. It is configured via the `syncPolicy.automated` field in the Application manifest, and can include options like self-heal and prune. It does not manage credentials, health check frequency, or branch selection.

Answer

It sets the password for the Git repository.

Answer

It configures the frequency of the container health checks.

Answer

It determines which Git branch is used for the deployment.