CGOA Gitops Terminology Practice Test 5 — 15 Questions

Question 1

You are comparing GitOps deployment models. Which scenario best describes a 'Pull' deployment model?

Accepted Answer

A Flux controller monitors the Git repository and updates the cluster state internally.. A Pull-based GitOps model is characterised by an in-cluster agent (such as Flux or Argo CD) that continuously monitors the Git repository and pulls the desired state into the cluster, reconciling any differences itself. The Flux controller watching Git and updating cluster state internally is the textbook example of this pattern. The cluster initiates the connection, which improves security because no external system needs cluster credentials.

Answer

A webhook triggers a Jenkins job to build and deploy an application.

Answer

A developer runs a helm upgrade command from their local machine to the cluster.

Answer

A Jenkins CI pipeline executes kubectl apply commands against the production cluster.

Question 2

A cluster is flagged as 'OutOfSync' in Argo CD. What does this status specifically indicate?

Accepted Answer

The live state in the Kubernetes cluster deviates from the version-controlled manifest.. In Argo CD, 'OutOfSync' specifically means the live resources in the Kubernetes cluster do not match the manifests stored in the Git repository. Argo CD continuously compares the desired state (from Git) against the live state (from the cluster API) and flags any divergence. It says nothing about the health of Git itself or the cluster's resource capacity — those are separate status dimensions.

Answer

The Git repository contains a syntax error in the YAML files.

Answer

The Kubernetes API server is unreachable.

Answer

The cluster has run out of memory or CPU resources.

Question 3

You are architecting a multi-cluster deployment. What is the benefit of using an 'Operator' based architecture over a standard CI/CD Push approach in this context?

Accepted Answer

It removes the need to store sensitive cluster administrative credentials in an external CI/CD tool.. An Operator runs inside the cluster and continuously reconciles desired state from custom resources, so it can authenticate using its own in-cluster ServiceAccount rather than requiring an external CI/CD system to hold cluster-admin kubeconfig or tokens. This inverts the trust model: the CI pipeline only needs to commit manifests or trigger a CR, while the Operator performs privileged actions locally. It also enables pull-based GitOps workflows where the cluster fetches changes instead of an external tool pushing them.

Answer

It allows the CI pipeline to run faster by offloading deployment tasks.

Answer

It ensures that the Git repository is automatically updated with the latest cluster metrics.

Answer

It forces developers to use the CLI for all infrastructure changes.

Question 4

When a manual change is made directly to a Kubernetes Service via 'kubectl edit', what behavior is expected from a properly configured GitOps operator set to 'Automatic Sync'?

Accepted Answer

The operator identifies the drift and automatically overwrites the live state with the Git version.. With Automatic Sync enabled, a GitOps operator such as Argo CD continuously compares live cluster state against the desired state in Git. When it detects drift — for example, a manual kubectl edit to a Service — it automatically re-applies the Git version, overwriting the manual change. This self-healing behaviour is the core guarantee of GitOps: Git remains the single source of truth.

Answer

The operator ignores the change to prevent production downtime.

Answer

The operator updates the Git repository to match the new manual change.

Answer

The operator prompts the administrator for manual approval before reverting.

Question 5

In the context of GitOps, what is the primary role of the 'Source of Truth'?

Accepted Answer

To serve as the definitive, version-controlled repository for the system's desired configuration.. In GitOps, the Source of Truth is the Git repository that holds the declarative, version-controlled desired state of the entire system. All deployments and reconciliations are driven from this repository, making it the authoritative reference for what the infrastructure and applications should look like. Any divergence between the cluster and Git is treated as drift to be corrected.

Answer

To store the database backups for the application.

Answer

To host the container images used by the applications.

Answer

To act as the runtime environment where pods are scheduled.

Question 6

Your team wants to implement GitOps. Which of the following is a critical prerequisite for 'Drift Detection' to be effective?

Accepted Answer

The operator must have read access to the Git repository and the cluster's current live state.. Drift detection in GitOps works by continuously comparing the desired state stored in Git with the actual live state of the cluster. To perform this comparison, the GitOps operator (e.g., Argo CD, Flux) must be able to read both the Git repository (to fetch the desired manifests) and the cluster's live resources (to observe the current state). Without read access to both, the operator cannot detect any divergence, making drift detection impossible.

Answer

The cluster must have an external load balancer exposed to the internet.

Answer

Developers must manually commit to Git every time a pod restarts.

Answer

The Git repository must contain the running container images themselves.

Question 7

Which TWO of the following are primary benefits of adopting a GitOps 'Pull' model compared to a 'Push' model? (Choose two)

Accepted Answer

It improves security by removing the need for long-lived cluster credentials in external CI systems.. Option B is correct because in a GitOps Pull model an in-cluster agent (e.g., Argo CD or Flux) reconciles the desired state from Git, so external CI systems no longer need long-lived cluster credentials such as kubeconfig files or service account tokens to push changes into the cluster. Option D is correct because the same in-cluster agent initiates outbound connections to Git and the cluster API stays internal, so the Kubernetes API server does not need to be exposed to external CI/CD tools, shrinking the attack surface. The unmarked options do not belong: A is false because Pull-based GitOps typically adds components (the reconciler/agent) and can make initial setup more involved, not simpler; C is false because GitOps does not inherently reduce the number of containers running in the cluster and usually adds the agent's own pods; and E is false because GitOps reconciles Git to the cluster, not the reverse, so manual cluster changes are reverted rather than automatically committed back to Git.

Answer

It simplifies the initial setup of CI/CD pipelines.

Answer

It reduces the total number of containers running in the cluster.

Answer

It ensures that manual cluster changes are automatically committed to the Git repository.

Question 8

Which THREE of the following are common tasks performed by a GitOps Operator? (Choose three)

Accepted Answer

Applying configurations to the cluster to resolve detected drift.. Option A is correct because a GitOps Operator continuously reconciles the cluster by applying the desired configuration from Git whenever it detects drift between the live state and the declared state. Option C is correct because the operator's core reconciliation loop compares the actual cluster state against the desired state stored in Git to determine whether any action is needed. Option E is correct because the operator continuously monitors the Git repository (e.g., via polling or webhooks) for new commits so it can pull and apply updated manifests. Option B is not a GitOps Operator task, since unit testing of manifests is a CI/development activity rather than runtime reconciliation. Option D is also not a GitOps Operator task, because building and pushing container images belongs to a CI pipeline (e.g., Jenkins, GitHub Actions), not to the operator that syncs cluster state.

Answer

Generating unit tests for Kubernetes manifests.

Answer

Building and pushing new Docker images to a registry.

Question 9

Which TWO of the following are considered 'Anti-Patterns' in a GitOps workflow? (Choose two)

Accepted Answer

Storing sensitive secrets as plain text in the Git repository.. Option A is correct because committing secrets as plain text in Git exposes credentials to anyone with repository read access and permanently embeds them in Git history, violating GitOps' declarative, auditable, and secure source-of-truth model; secrets should instead be managed with tools like Sealed Secrets, SOPS, or an external secrets manager. Option C is correct because making manual changes directly to the production cluster creates configuration drift from the Git-declared desired state, breaking the core GitOps principle that Git is the single source of truth and that all changes flow through version control and automated reconciliation. Option B is not an anti-pattern; using branches (or directories) per environment is a legitimate, widely used GitOps repository strategy for separating prod and dev configurations. Option D is not an anti-pattern; automating deployment with a GitOps operator such as Argo CD or Flux is the intended practice, as it continuously reconciles cluster state with Git. Option E is not an anti-pattern; storing application manifests in a central repository is a standard GitOps pattern that provides a single, versioned source of truth for deployments.

Answer

Using a Git branch to represent a specific environment (e.g., prod vs dev).

Answer

Automating the deployment process using a GitOps operator.

Answer

Storing application manifests in a central repository.

Question 10

A platform team manages a Kubernetes cluster with Flux. They want to ensure that if the cluster's live state diverges from the Git repository, the system automatically corrects it without human intervention. Which GitOps concept does this describe?

Accepted Answer

Reconciliation. Reconciliation is the continuous process by which a GitOps operator like Flux or Argo CD compares the desired state stored in Git with the actual state of the cluster and automatically applies any necessary changes to eliminate drift. This self-healing behavior is exactly what the platform team requires to maintain consistency without manual intervention.

Answer

Immutable Infrastructure

Answer

Continuous Delivery

Answer

Declarative Configuration

Question 11

A platform team runs Argo CD against a Git repository that holds Helm charts for a production cluster. During an incident, an SRE patches a Deployment directly with `kubectl set image` to roll back a bad release. Two minutes later the Deployment is back on the bad image. Which GitOps concept explains why the manual patch did not persist?

Accepted Answer

Continuous reconciliation, because the agent continuously converges live state toward the declared desired state in Git.. The agent's repeated comparison of live state against the Git-declared desired state is what undid the manual patch. GitOps operators run a control loop that detects divergence and reapplies the repository content, so imperative changes are transient by design. The other concepts describe rollout strategy, infrastructure replacement, or governance policy, none of which actively rewrites a mutated Deployment object.

Answer

Git as the single source of truth, because Kubernetes refuses API writes that were not committed to the repository.

Answer

Progressive delivery, because the agent automatically reverts any change that fails a health gate.

Answer

Immutable infrastructure, because Kubernetes replaces any container whose image differs from the manifest.

Question 12

A startup is adopting GitOps for its Kubernetes platform. The CTO asks the platform engineer to describe the defining property of the deployment model they are about to adopt. Which statement best captures the core GitOps principle?

Accepted Answer

The desired state of the system is declared in Git, and automated agents continuously converge the running system toward it.. GitOps is defined by declarative desired state stored in Git plus automated agents that continuously reconcile the running system to match it. Push-based pipelines, ticketing gates, and operator patterns are related but not the defining property. The convergence loop and the versioned declarative source are what make the model auditable, reproducible, and self-healing.

Answer

Operators package application logic into custom controllers that manage the full lifecycle of their own resources.

Answer

Every production change requires a change advisory board approval recorded in an external ticketing system before deployment.

Answer

Application artifacts are built in CI and pushed to the cluster by the pipeline after every merge to the main branch.

Question 13

A financial services firm deploys Argo CD to manage three production clusters. Auditors ask how the firm can prove that no unauthorized change reached production in the last quarter. Which GitOps property most directly satisfies this audit requirement?

Accepted Answer

An immutable, signed Git history records every approved desired-state change, and reconciliation makes the cluster match that history.. Git's immutable, reviewable, and optionally signed commit history gives auditors a verifiable record of every intended production change, and reconciliation ensures the cluster reflects exactly that history. Dashboards are transient, Kubernetes audit logs are short-lived and lack approval context, and RBAC is preventive rather than evidentiary. Together, versioned history plus automated convergence provides the provenance auditors require.

Answer

The Argo CD UI maintains a dashboard showing the sync status of every application across all clusters.

Answer

Role-based access control on each cluster restricts kubectl access to a small group of senior engineers.

Answer

Kubernetes audit logs capture every API request made to each cluster's control plane.

Question 14

A team uses Flux to manage a cluster. They want the cluster to automatically apply new commits to a configuration repository without any external pipeline pushing to the cluster. Which Flux component and behavior accomplish this?

Accepted Answer

The source-controller watches the Git repository and produces an artifact that the kustomize-controller reconciles into the cluster.. Flux's pull-based model is implemented by the source-controller fetching repository content and producing artifacts that the kustomize-controller then reconciles into the cluster. This lets in-cluster agents detect and apply new commits without external pipeline credentials. The notification, helm, and image-reflector controllers serve different roles and do not themselves apply the changed manifests from Git.

Answer

The notification-controller receives webhooks from the Git host and applies the changed manifests itself.

Answer

The helm-controller polls the Git repository directly and renders charts during each reconciliation cycle.

Answer

The image-reflector-controller scans the container registry and commits updated tags back to the configuration repository.

Question 15

A platform team is designing a GitOps workflow and wants to avoid common failure modes that undermine the model's guarantees. Which TWO practices undermine a GitOps workflow? (Choose two.)

Accepted Answer

Using long-lived cluster-admin credentials in an external CI pipeline to push manifests into production clusters.. GitOps depends on Git being the authoritative, continuously reconciled source of truth. Uncommitted kubectl changes and push-based pipelines using long-lived privileged credentials both bypass that authority, leaving the cluster and the repository out of sync and weakening auditability. Environment overlays, pull-request review, and automated self-heal are recommended practices that reinforce the model rather than undermine it.

Answer

Storing separate configuration for each environment in distinct directories within the same repository, managed with overlays.

Answer

Requiring pull-request review and automated policy checks before merging changes to the configuration repository.

Answer

Enabling automated sync with self-heal so the agent continuously corrects divergence from the declared state.