CGOA Related Practices — 10 Questions

Question 1

Which scenario demonstrates the most effective way to manage environment-specific configurations in a large-scale GitOps setup?

Accepted Answer

Creating environment-specific branches and using a templating tool to apply overrides.. Environment-specific branches combined with a templating tool (Helm, Kustomize, Jsonnet) let you keep a single source of truth for base manifests while applying per-environment overrides declaratively. This scales cleanly because changes to shared components propagate through the template, and environment drift is minimized. It is the pattern most GitOps practitioners (Argo CD, Flux) recommend for large multi-environment deployments.

Answer

Storing all configurations in a single large YAML file.

Answer

Copying and pasting the entire manifest directory for each environment.

Answer

Ignoring environment differences and using the same values for everything.

Question 2

When implementing GitOps, what is the 'GitOps Operator' pattern specifically meant to solve?

Accepted Answer

It eliminates the need for any manual interaction with the cluster.. The GitOps Operator pattern is designed to eliminate manual interaction with the cluster by continuously reconciling the desired state declared in Git with the actual state in the cluster. The operator watches Git repositories and applies changes automatically, so engineers never need to run kubectl commands manually. This is the core value proposition of GitOps: declarative, automated, and auditable cluster management.

Answer

It automates the building of Docker images.

Answer

It replaces the need for a Git repository.

Answer

It provides a user interface for cluster management.

Question 3

Your organization is transitioning from imperative scripts to Infrastructure as Code (IaC) using Terraform. You need to ensure that the infrastructure state remains synchronized with the Git repository after every commit. Which approach best aligns with GitOps principles?

Accepted Answer

Deploy a GitOps controller like Flux or Argo CD to monitor the Terraform state files in Git and apply changes automatically.. GitOps principles require a controller that continuously reconciles live state with the desired state stored in Git. Deploying Flux or Argo CD to monitor Terraform state files (or Terraform manifests via tools like Crossplane or the Terraform Controller) and apply changes automatically is the pull-based, declarative approach that matches GitOps. Manual approvals, cron jobs, and webhook-triggered shell scripts are push-based or scheduled and do not provide continuous reconciliation.

Answer

Configure a CI pipeline to run terraform apply only when a manual approval is provided by the operations team.

Answer

Execute a scheduled cron job that runs terraform apply.

Answer

Use a webhook to trigger a shell script that pulls the latest changes from the main branch.

Question 4

Why is 'Git' considered the 'source of truth' in GitOps?

Accepted Answer

Because it acts as the single point of record for the desired system state.. In GitOps, Git is the source of truth because it stores the declarative desired state of the entire system—manifests, configs, and policies—as versioned, reviewable commits. The GitOps controller continuously reconciles the live cluster to match what Git declares, so Git is the authoritative record. It does not store logs, is not the only tool with branching, and does not run applications itself.

Answer

Because Git stores all application logs.

Answer

Because it is the only tool that supports branching.

Answer

Because Git automatically runs the applications.

Question 5

In a GitOps environment, what is the main purpose of maintaining Infrastructure as Code?

Accepted Answer

To ensure that infrastructure can be defined, tracked, and automatically reconciled from Git.. In a GitOps environment, Infrastructure as Code exists so that infrastructure is declared in version-controlled files, tracked through Git history, and automatically reconciled by a controller to match the declared state. This makes infrastructure reproducible, auditable, and self-healing, which is the foundation of the GitOps operating model.

Answer

To avoid using cloud provider dashboards.

Answer

To generate cost reports for the finance department.

Answer

To allow developers to log into servers and make changes.

Question 6

Your organization wants to implement DevSecOps by integrating security scanning into a GitOps pipeline. Where should the vulnerability scan happen to prevent insecure configurations from ever reaching the cluster?

Accepted Answer

During the CI phase, scanning the Kubernetes manifests for security misconfigurations before merging.. To prevent insecure configurations from reaching the cluster, scanning must occur early in the CI phase, ideally on the Kubernetes manifests before they are merged into the Git repository. This shift-left approach catches misconfigurations before deployment, aligning with DevSecOps principles.

Answer

Only when an auditor requests a security report.

Answer

By running an automated script to delete pods that fail a security check.

Answer

As a post-deployment check using a Kubernetes admission controller.

Question 7

A company uses Terraform for IaC and Argo CD for application delivery. How should they manage the dependency between infrastructure provisioning and app deployment to ensure GitOps consistency?

Accepted Answer

Use Crossplane to represent infrastructure as Kubernetes objects, managing both IaC and apps via GitOps.. Crossplane extends Kubernetes with CRDs so infrastructure (cloud resources, databases, networks) is represented as Kubernetes objects, meaning Argo CD can reconcile both infrastructure and application manifests from Git using the same GitOps control loop. This eliminates the ordering problem because Argo CD's sync waves and health checks can sequence infrastructure readiness before dependent apps deploy. The other options break GitOps consistency by introducing imperative, out-of-band steps.

Answer

Execute Terraform via a CI job that triggers Argo CD after completion.

Answer

Manually trigger Terraform runs before pushing new app manifests to Git.

Answer

Embed Terraform binary execution within a K8s deployment container.

Question 8

When mapping a traditional CI/CD pipeline to GitOps, what is the primary role of the CD tool?

Accepted Answer

Reconciling the running state of the cluster with the declarative state defined in Git.. In GitOps, the CD tool (e.g., Argo CD or Flux) acts as a reconciliation controller that continuously compares the desired state declared in Git against the live cluster state and applies any drift corrections. It does not build or push artifacts — that is the CI system's job. The CD tool's core function is to pull the declarative manifests from Git and ensure the cluster matches them.

Answer

Pushing binary artifacts to a server via SSH.

Answer

Pushing images to a container registry after a build.

Answer

Generating test reports for the QA team.

Question 9

You are debugging a drift in a GitOps environment. The cluster state differs from the Git repository. What is the most likely cause if you are using Flux?

Accepted Answer

A user performed a manual 'kubectl' command to modify a deployment.. Flux continuously reconciles the cluster state with the desired state defined in Git. If a user manually modifies a resource with kubectl, that change is not in Git, so Flux will detect the drift and may revert it. This is the most likely cause of drift in a GitOps environment because Git is the single source of truth. Other options would typically cause deployment failures or prevent updates, but not drift between Git and the cluster.

Answer

The container registry is unreachable during a new image rollout.

Answer

The Git repository contains syntax errors in the YAML files.

Answer

The CI pipeline failed to run tests.

Question 10

Which practice represents the 'DevSecOps' aspect in a GitOps pipeline?

Accepted Answer

Enforcing policy constraints via OPA/Gatekeeper that validate manifests against security rules.. Enforcing policy constraints via OPA/Gatekeeper that validate manifests against security rules is correct because it embeds automated, policy-as-code security checks directly into the GitOps reconciliation loop. In a GitOps pipeline, the Git repository is the source of truth and Argo CD or Flux continuously syncs cluster state to it; Gatekeeper's admission webhook intercepts manifest creation/updates and rejects any resource that violates OPA Rego policies. This makes security a continuous, version-controlled, and automated part of every deployment, which is the essence of DevSecOps—shifting security left into the development and operations workflow rather than treating it as a separate gate.

Answer

Conducting quarterly penetration tests.

Answer

Requiring a manual sign-off by a security officer for every deployment.

Answer

Storing secrets in plain text in the Git repository.