CGOA Related Practices — 10 Questions

Question 1

Why is 'Git' considered the 'source of truth' in GitOps?

Accepted Answer

Because it acts as the single point of record for the desired system state.. Git provides a clear, immutable, and auditable history of every change made to the system, which is essential for reproducibility.

Answer

Because Git stores all application logs.

Answer

Because it is the only tool that supports branching.

Answer

Because Git automatically runs the applications.

Question 2

In a GitOps environment, what is the main purpose of maintaining Infrastructure as Code?

Accepted Answer

To ensure that infrastructure can be defined, tracked, and automatically reconciled from Git.. IaC allows the entire infrastructure stack to be versioned, audited, and recreated reliably, mirroring the application deployment process.

Answer

To avoid using cloud provider dashboards.

Answer

To generate cost reports for the finance department.

Answer

To allow developers to log into servers and make changes.

Question 3

Your organization wants to implement DevSecOps by integrating security scanning into a GitOps pipeline. Where should the vulnerability scan happen to prevent insecure configurations from ever reaching the cluster?

Accepted Answer

During the CI phase, scanning the Kubernetes manifests for security misconfigurations before merging.. Shifting left means scanning code before it is applied to the cluster, ensuring the Git repository acts as a gatekeeper.

Answer

Only when an auditor requests a security report.

Answer

By running an automated script to delete pods that fail a security check.

Answer

As a post-deployment check using a Kubernetes admission controller.

Question 4

A company uses Terraform for IaC and Argo CD for application delivery. How should they manage the dependency between infrastructure provisioning and app deployment to ensure GitOps consistency?

Accepted Answer

Use Crossplane to represent infrastructure as Kubernetes objects, managing both IaC and apps via GitOps.. Using a tool like Crossplane or an orchestrator ensures that infrastructure and applications are synchronized through the same Git-based reconciliation loop.

Answer

Execute Terraform via a CI job that triggers Argo CD after completion.

Answer

Manually trigger Terraform runs before pushing new app manifests to Git.

Answer

Embed Terraform binary execution within a K8s deployment container.

Question 5

When mapping a traditional CI/CD pipeline to GitOps, what is the primary role of the CD tool?

Accepted Answer

Reconciling the running state of the cluster with the declarative state defined in Git.. In GitOps, the CD tool acts as a continuous reconciler that pulls changes from Git to match the cluster state.

Answer

Pushing binary artifacts to a server via SSH.

Answer

Pushing images to a container registry after a build.

Answer

Generating test reports for the QA team.

Question 6

You are debugging a drift in a GitOps environment. The cluster state differs from the Git repository. What is the most likely cause if you are using Flux?

Accepted Answer

A user performed a manual 'kubectl' command to modify a deployment.. Flux reconcilers periodically verify the cluster state; drift usually occurs when an external actor modifies the cluster directly or a manual change occurred.

Answer

The container registry is unreachable during a new image rollout.

Answer

The Git repository contains syntax errors in the YAML files.

Answer

The CI pipeline failed to run tests.

Question 7

Which practice represents the 'DevSecOps' aspect in a GitOps pipeline?

Accepted Answer

Enforcing policy constraints via OPA/Gatekeeper that validate manifests against security rules.. Policy-as-code tools like OPA/Gatekeeper allow for security policies to be versioned in Git and enforced automatically during the deployment process.

Answer

Conducting quarterly penetration tests.

Answer

Requiring a manual sign-off by a security officer for every deployment.

Answer

Storing secrets in plain text in the Git repository.

Question 8

A team is transitioning from traditional imperative scripts to declarative Configuration as Code. Which approach best satisfies the GitOps principle of using a desired state definition?

Accepted Answer

Storing Kubernetes YAML manifests in a Git repository and using an operator to synchronize them.. GitOps requires that the desired state be declared in a version-controlled repository to ensure traceability and auditability.

Answer

Using bash scripts triggered by a Jenkins build job to update environment variables.

Answer

Directly editing deployments via the 'kubectl edit' command.

Answer

Using an Ansible playbook to perform one-off configuration changes on existing servers.

Question 9

You are implementing a multi-environment strategy. Which Git branching strategy best supports GitOps?

Accepted Answer

Using dedicated directories for each environment within a single repository.. Environment-specific branches or directory-based separation (using Kustomize or Helm) allow for tracking changes across dev, staging, and prod independently.

Answer

Deleting the Git repository after each deployment to prevent tampering.

Answer

Using a single 'main' branch that is pushed to all environments simultaneously.

Answer

Creating a new repository for every single deployment.

Question 10

When implementing a CI/CD pipeline for GitOps, how should you handle image tag updates?

Accepted Answer

Using an automated agent that detects new images and commits the tag change back to the Git repo.. Automating image updates through a tool like Renovate or Argo CD Image Updater ensures the repository is kept in sync with the latest build artifacts.

Answer

Having the CD operator pull the 'latest' tag directly from the registry.

Answer

Manually updating the YAML file with the new image tag and committing to Git.

Answer

Triggering a shell script to update the cluster state directly from the CI pipeline.