CGOA Gitops Terminology Practice Test 3 — 15 Questions

Question 1

Why is 'Git' used as the source of truth rather than a standard database?

Accepted Answer

Git provides native versioning, history, and collaboration. Git is used as the source of truth because it natively provides versioning, full history, branching, and collaboration workflows (pull requests, reviews, merges) that a standard database does not offer out of the box. These properties make configuration changes auditable, reviewable, and reversible — the foundation of GitOps.

Answer

Git is the only format Kubernetes supports

Answer

Git is easier to host on-premise

Answer

Git is faster at read operations

Question 2

In an Argo CD 'Application' manifest, what does the 'destination' field specify?

Accepted Answer

The Kubernetes cluster and namespace for deployment. In an Argo CD Application manifest, the destination field defines where the application's manifests will be deployed — specifically the target Kubernetes cluster (by server URL or name) and the target namespace. It is paired with the source field, which points to the Git repository and path containing the desired manifests. Together, source + destination describe the 'what' and the 'where' of the GitOps deployment.

Answer

The source Git repository URL

Answer

The build server address

Answer

The email address for alerts

Question 3

Which THREE of the following are valid ways to trigger a sync in a GitOps environment?

Accepted Answer

Pushing a commit to the Git repository. Option A is correct because in a GitOps model the Git repository is the single source of truth, so pushing a commit changes the desired state and the GitOps controller (e.g., Argo CD or Flux) detects the new revision and reconciles the cluster to match it. Option B is correct because GitOps tools such as Argo CD expose a manual 'Sync' action in their UI/dashboard that forces the controller to apply the current desired manifests immediately, regardless of the automatic polling interval. Option E is correct because Git providers like GitHub, GitLab, or Bitbucket can send webhook notifications to the GitOps controller's endpoint, letting it react instantly to repository events instead of waiting for the next poll cycle. Option C is not valid because SSH access to a node is an imperative administrative action that does not alter the Git-declared desired state and is not a GitOps sync trigger. Option D is not valid because restarting the Kubernetes API server is an infrastructure operation that does not change or re-read the Git source of truth and is unrelated to triggering reconciliation.

Answer

Logging into the node via SSH

Answer

Restarting the Kubernetes API server

Question 4

What does the status 'OutOfSync' indicate in Argo CD?

Accepted Answer

The live resources are not identical to the Git manifests. In Argo CD, the 'OutOfSync' status indicates that the live state of the resources in the Kubernetes cluster does not match the desired state defined in the Git manifests. Argo CD continuously compares the two and flags any drift, allowing operators to detect and reconcile differences. This is a core part of GitOps: Git is the source of truth, and any deviation is considered out of sync.

Answer

The Git repository is empty

Answer

The application is running out of memory

Answer

The Argo CD server is offline

Question 5

What does the term 'Self-Healing' mean in a GitOps context?

Accepted Answer

The system automatically restores the desired state if someone manually modifies the cluster. Self-healing in GitOps refers to the operator's ability to detect when the live cluster state diverges from the desired state stored in Git and automatically restore the desired state. If someone manually edits or deletes a resource, the operator reverts the change to match Git. This enforces Git as the single source of truth and prevents configuration drift.

Answer

The application automatically updates its own code

Answer

The cluster automatically reboots upon failure

Answer

The database automatically backs itself up

Question 6

What is the role of a 'Webhook' in a GitOps setup?

Accepted Answer

To inform the operator of a change in the Git repository. A webhook in a GitOps setup is a notification mechanism: the Git provider (GitHub, GitLab, Bitbucket) sends an HTTP POST to the operator's endpoint whenever a push, merge, or tag occurs, prompting the operator to reconcile immediately. This reduces the latency between a Git commit and cluster convergence compared to relying solely on periodic polling.

Answer

To store encrypted credentials

Answer

To scan container images for vulnerabilities

Answer

To automatically approve pull requests

Question 7

Which THREE of the following are common components of a GitOps platform?

Accepted Answer

CI Pipeline (e.g., GitHub Actions). A GitOps platform typically includes a CI pipeline such as GitHub Actions (option A), which builds, tests, and produces the immutable artifacts (container images, manifests) that the GitOps workflow then deploys. The Git repository (option C) is the declarative source of truth: it stores the desired state of the cluster, and every change is made via commits and pull requests rather than direct kubectl commands. The GitOps operator (option E), such as Argo CD or Flux, runs inside the cluster, continuously reconciles the live state against the repository, and reports or auto-corrects drift. An external load balancer (option B) is an infrastructure/routing component, not a defining part of a GitOps platform, and a manual deployment script (option D) contradicts GitOps' declarative, automated, pull-based reconciliation model.

Answer

External Load Balancer

Answer

Manual Deployment Script

Question 8

In GitOps, what should happen if a configuration file is deleted from the Git repository?

Accepted Answer

The operator deletes the resource from the cluster. In GitOps, Git is the single source of truth for desired state. If a manifest is deleted from Git, the desired state no longer includes that resource, so the operator's reconciliation loop will delete the corresponding resource from the cluster to converge live state with Git. This is the declarative, self-healing behaviour that makes GitOps predictable.

Answer

The operator alerts the admin and stops

Answer

The cluster keeps the resource forever

Answer

The operator ignores the change

Question 9

How does an operator manage 'Secrets' in a GitOps repository?

Accepted Answer

By using specialized tools or controllers to decrypt secrets at runtime. Because Git repositories are not designed to store plaintext secrets securely, GitOps practitioners use specialized tools — such as Sealed Secrets, SOPS, External Secrets Operator, or Vault integrations — to encrypt secrets at rest in Git and decrypt them at runtime inside the cluster. The encrypted blob is committed to the repo, and a controller decrypts it into a native Kubernetes Secret when syncing. This preserves Git as the source of truth without exposing credentials.

Answer

By disabling secrets entirely

Answer

By storing them as plain text in the repo

Answer

By hardcoding them in the application code

Question 10

What does 'Declarative Configuration' imply in GitOps?

Accepted Answer

The system is defined by files that describe the desired final state. Declarative configuration means you write files (YAML manifests, Helm charts, Kustomize overlays) that describe the desired end state of the system, and a controller continuously reconciles actual state to match. You declare 'what' the system should look like, not 'how' to get there step by step. This is the foundation of GitOps because the declarative files can be version-controlled and diffed.

Answer

Only developers can access the system

Answer

The database is the source of truth

Answer

You must manually type every command

Question 11

Which THREE of the following are best practices for managing GitOps secrets?

Accepted Answer

Encrypt secrets using tools like SealedSecrets. Option B is correct because SealedSecrets encrypts secrets with a controller-held private key so the ciphertext can be safely committed to a Git repository and decrypted only inside the cluster, which fits GitOps' declarative, version-controlled workflow. Option C is correct because an external secret manager such as HashiCorp Vault keeps the actual secret material outside Git and injects it at runtime, so the repository stores only references or paths rather than sensitive values. Option D is correct because regularly rotating secrets according to security policies limits the blast radius of any leaked credential and is a core secrets-management control. Option A is wrong because sharing secrets in cleartext via team chat exposes them to logs, backups, and unauthorized members. Option E is wrong because base64 is merely an encoding, not encryption, so anyone with repository access can trivially decode the secrets.

Answer

Share secrets in cleartext via team chat

Answer

Store base64 encoded secrets in Git

Question 12

What is the purpose of 'App-of-Apps' pattern in Argo CD?

Accepted Answer

To manage a collection of applications via a single root application. The App-of-Apps pattern in Argo CD uses a single root Application whose manifests define multiple child Applications. Syncing the root application creates or updates all the child applications, enabling centralised management of a large collection of applications. This hierarchical approach simplifies bootstrapping and governance across many services or clusters.

Answer

To perform parallel builds

Answer

To increase the memory capacity of the cluster

Answer

To allow multiple users to edit the same file

Question 13

In a GitOps environment, what is the role of a 'CI Pipeline'?

Accepted Answer

To validate changes and commit them to the GitOps repo. In GitOps, the CI pipeline's job is to build, test, and validate changes, then commit the resulting manifests (or updated image tags) into the GitOps repository. The GitOps operator (e.g., Argo CD or Flux) then detects the commit and reconciles the cluster to match. CI produces the desired state; the GitOps controller applies it.

Answer

To replace the GitOps operator

Answer

To execute the reconciliation loop

Answer

To handle user authentication for the cluster

Question 14

What is the primary benefit of version controlling your cluster manifests?

Accepted Answer

It allows you to track, audit, and revert cluster changes. Version controlling cluster manifests (e.g., YAML files for Kubernetes resources) provides a historical record of every change made to the desired state of the cluster. This enables tracking who changed what and when, auditing for compliance or troubleshooting, and reverting to a previous working state if a change causes issues. These capabilities are core to GitOps and infrastructure-as-code practices, where the manifest repository is the single source of truth for cluster configuration.

Answer

It allows you to host files on your local desktop

Answer

It replaces the need for a database

Answer

It speeds up node startup time

Question 15

Which TWO of the following are valid ways to configure an Argo CD 'Application'?

Accepted Answer

By applying a YAML manifest via kubectl. Option C is correct because an Argo CD Application is a Kubernetes custom resource (CRD) of kind Application in the argoproj.io API group, so it can be created or updated declaratively by applying a YAML manifest with kubectl (e.g., kubectl apply -f application.yaml). Option D is correct because the Argo CD CLI provides commands such as 'argocd app create' and 'argocd app set' that configure an Application through the Argo CD API server. Option A is incorrect because modifying the Argo CD binary is neither a supported nor a practical configuration method and would not define an Application resource. Option B is incorrect because bypassing the API server is not a valid configuration path; Argo CD Applications are managed through the Kubernetes API or Argo CD API. Option E is incorrect because deleting the Git repository removes the source of manifests and does not configure an Application.

Answer

By modifying the Argo CD binary code

Answer

By writing a shell script that bypasses the API server

Answer

By deleting the Git repository