CGOA Related Practices — 25 Questions

Question 1

Which scenario demonstrates the most effective way to manage environment-specific configurations in a large-scale GitOps setup?

Accepted Answer

Creating environment-specific branches and using a templating tool to apply overrides.. Environment-specific branches combined with a templating tool (Helm, Kustomize, Jsonnet) let you keep a single source of truth for base manifests while applying per-environment overrides declaratively. This scales cleanly because changes to shared components propagate through the template, and environment drift is minimized. It is the pattern most GitOps practitioners (Argo CD, Flux) recommend for large multi-environment deployments.

Answer

Storing all configurations in a single large YAML file.

Answer

Copying and pasting the entire manifest directory for each environment.

Answer

Ignoring environment differences and using the same values for everything.

Question 2

When implementing GitOps, what is the 'GitOps Operator' pattern specifically meant to solve?

Accepted Answer

It eliminates the need for any manual interaction with the cluster.. The GitOps Operator pattern is designed to eliminate manual interaction with the cluster by continuously reconciling the desired state declared in Git with the actual state in the cluster. The operator watches Git repositories and applies changes automatically, so engineers never need to run kubectl commands manually. This is the core value proposition of GitOps: declarative, automated, and auditable cluster management.

Answer

It automates the building of Docker images.

Answer

It replaces the need for a Git repository.

Answer

It provides a user interface for cluster management.

Question 3

Your organization is transitioning from imperative scripts to Infrastructure as Code (IaC) using Terraform. You need to ensure that the infrastructure state remains synchronized with the Git repository after every commit. Which approach best aligns with GitOps principles?

Accepted Answer

Deploy a GitOps controller like Flux or Argo CD to monitor the Terraform state files in Git and apply changes automatically.. GitOps principles require a controller that continuously reconciles live state with the desired state stored in Git. Deploying Flux or Argo CD to monitor Terraform state files (or Terraform manifests via tools like Crossplane or the Terraform Controller) and apply changes automatically is the pull-based, declarative approach that matches GitOps. Manual approvals, cron jobs, and webhook-triggered shell scripts are push-based or scheduled and do not provide continuous reconciliation.

Answer

Configure a CI pipeline to run terraform apply only when a manual approval is provided by the operations team.

Answer

Execute a scheduled cron job that runs terraform apply.

Answer

Use a webhook to trigger a shell script that pulls the latest changes from the main branch.

Question 4

Why is 'Git' considered the 'source of truth' in GitOps?

Accepted Answer

Because it acts as the single point of record for the desired system state.. In GitOps, Git is the source of truth because it stores the declarative desired state of the entire system—manifests, configs, and policies—as versioned, reviewable commits. The GitOps controller continuously reconciles the live cluster to match what Git declares, so Git is the authoritative record. It does not store logs, is not the only tool with branching, and does not run applications itself.

Answer

Because Git stores all application logs.

Answer

Because it is the only tool that supports branching.

Answer

Because Git automatically runs the applications.

Question 5

In a GitOps environment, what is the main purpose of maintaining Infrastructure as Code?

Accepted Answer

To ensure that infrastructure can be defined, tracked, and automatically reconciled from Git.. In a GitOps environment, Infrastructure as Code exists so that infrastructure is declared in version-controlled files, tracked through Git history, and automatically reconciled by a controller to match the declared state. This makes infrastructure reproducible, auditable, and self-healing, which is the foundation of the GitOps operating model.

Answer

To avoid using cloud provider dashboards.

Answer

To generate cost reports for the finance department.

Answer

To allow developers to log into servers and make changes.

Question 6

Your organization wants to implement DevSecOps by integrating security scanning into a GitOps pipeline. Where should the vulnerability scan happen to prevent insecure configurations from ever reaching the cluster?

Accepted Answer

During the CI phase, scanning the Kubernetes manifests for security misconfigurations before merging.. To prevent insecure configurations from reaching the cluster, scanning must occur early in the CI phase, ideally on the Kubernetes manifests before they are merged into the Git repository. This shift-left approach catches misconfigurations before deployment, aligning with DevSecOps principles.

Answer

Only when an auditor requests a security report.

Answer

By running an automated script to delete pods that fail a security check.

Answer

As a post-deployment check using a Kubernetes admission controller.

Question 7

A company uses Terraform for IaC and Argo CD for application delivery. How should they manage the dependency between infrastructure provisioning and app deployment to ensure GitOps consistency?

Accepted Answer

Use Crossplane to represent infrastructure as Kubernetes objects, managing both IaC and apps via GitOps.. Crossplane extends Kubernetes with CRDs so infrastructure (cloud resources, databases, networks) is represented as Kubernetes objects, meaning Argo CD can reconcile both infrastructure and application manifests from Git using the same GitOps control loop. This eliminates the ordering problem because Argo CD's sync waves and health checks can sequence infrastructure readiness before dependent apps deploy. The other options break GitOps consistency by introducing imperative, out-of-band steps.

Answer

Execute Terraform via a CI job that triggers Argo CD after completion.

Answer

Manually trigger Terraform runs before pushing new app manifests to Git.

Answer

Embed Terraform binary execution within a K8s deployment container.

Question 8

When mapping a traditional CI/CD pipeline to GitOps, what is the primary role of the CD tool?

Accepted Answer

Reconciling the running state of the cluster with the declarative state defined in Git.. In GitOps, the CD tool (e.g., Argo CD or Flux) acts as a reconciliation controller that continuously compares the desired state declared in Git against the live cluster state and applies any drift corrections. It does not build or push artifacts — that is the CI system's job. The CD tool's core function is to pull the declarative manifests from Git and ensure the cluster matches them.

Answer

Pushing binary artifacts to a server via SSH.

Answer

Pushing images to a container registry after a build.

Answer

Generating test reports for the QA team.

Question 9

You are debugging a drift in a GitOps environment. The cluster state differs from the Git repository. What is the most likely cause if you are using Flux?

Accepted Answer

A user performed a manual 'kubectl' command to modify a deployment.. Flux continuously reconciles the cluster state with the desired state defined in Git. If a user manually modifies a resource with kubectl, that change is not in Git, so Flux will detect the drift and may revert it. This is the most likely cause of drift in a GitOps environment because Git is the single source of truth. Other options would typically cause deployment failures or prevent updates, but not drift between Git and the cluster.

Answer

The container registry is unreachable during a new image rollout.

Answer

The Git repository contains syntax errors in the YAML files.

Answer

The CI pipeline failed to run tests.

Question 10

Which practice represents the 'DevSecOps' aspect in a GitOps pipeline?

Accepted Answer

Enforcing policy constraints via OPA/Gatekeeper that validate manifests against security rules.. Enforcing policy constraints via OPA/Gatekeeper that validate manifests against security rules is correct because it embeds automated, policy-as-code security checks directly into the GitOps reconciliation loop. In a GitOps pipeline, the Git repository is the source of truth and Argo CD or Flux continuously syncs cluster state to it; Gatekeeper's admission webhook intercepts manifest creation/updates and rejects any resource that violates OPA Rego policies. This makes security a continuous, version-controlled, and automated part of every deployment, which is the essence of DevSecOps—shifting security left into the development and operations workflow rather than treating it as a separate gate.

Answer

Conducting quarterly penetration tests.

Answer

Requiring a manual sign-off by a security officer for every deployment.

Answer

Storing secrets in plain text in the Git repository.

Question 11

A team is transitioning from traditional imperative scripts to declarative Configuration as Code. Which approach best satisfies the GitOps principle of using a desired state definition?

Accepted Answer

Storing Kubernetes YAML manifests in a Git repository and using an operator to synchronize them.. Storing Kubernetes YAML manifests in a Git repository and using an operator to synchronize them is the declarative GitOps approach. The YAML files define the desired state, and the operator continuously reconciles the cluster to match that state. This satisfies the principle of using a desired state definition because the state is versioned, immutable, and declarative.

Answer

Using bash scripts triggered by a Jenkins build job to update environment variables.

Answer

Directly editing deployments via the 'kubectl edit' command.

Answer

Using an Ansible playbook to perform one-off configuration changes on existing servers.

Question 12

You are implementing a multi-environment strategy. Which Git branching strategy best supports GitOps?

Accepted Answer

Using dedicated directories for each environment within a single repository.. In GitOps, the desired state of each environment is stored declaratively in Git, and a controller (e.g., Argo CD or Flux) continuously reconciles the live state to match it. Using dedicated directories per environment within a single repository (e.g., /envs/dev, /envs/staging, /envs/prod) allows each environment to have its own manifests and configuration while sharing common base resources via Kustomize or Helm. This structure supports promotion workflows (e.g., merging changes from dev to staging to prod) and provides clear separation without the overhead of multiple repositories. It also aligns with the principle of a single source of truth for all environments, making it easier to audit and manage drift.

Answer

Deleting the Git repository after each deployment to prevent tampering.

Answer

Using a single 'main' branch that is pushed to all environments simultaneously.

Answer

Creating a new repository for every single deployment.

Question 13

When implementing a CI/CD pipeline for GitOps, how should you handle image tag updates?

Accepted Answer

Using an automated agent that detects new images and commits the tag change back to the Git repo.. In GitOps, Git is the single source of truth for declarative infrastructure and application state. An automated agent (such as Argo CD Image Updater or Flux's image-reflector/image-automation controllers) watches the container registry for new image digests/tags, then writes the updated tag back into the Git manifest and commits it. The CD operator then reconciles the cluster to match the newly committed state, preserving the audit trail and rollback capability that GitOps requires.

Answer

Having the CD operator pull the 'latest' tag directly from the registry.

Answer

Manually updating the YAML file with the new image tag and committing to Git.

Answer

Triggering a shell script to update the cluster state directly from the CI pipeline.

Question 14

What is the primary benefit of using a pull-based GitOps operator compared to a push-based CI/CD system?

Accepted Answer

The cluster does not need inbound access from the CI pipeline.. In a pull-based GitOps model, the operator runs inside the cluster and continuously pulls the desired state from Git. This means the CI system does not need to connect to the cluster's API server, eliminating the need for inbound access to the cluster from external systems. This improves security by reducing the attack surface.

Answer

It eliminates the need for container registries.

Answer

You can use fewer Git branches.

Answer

The CI system runs faster.

Question 15

When configuring a GitOps pipeline, what should be done to manage sensitive data like API keys?

Accepted Answer

Use a tool like Sealed Secrets to encrypt them before committing to Git.. Sealed Secrets is a Kubernetes controller and tool that allows you to encrypt secrets into a 'SealedSecret' resource that is safe to store in a Git repository. The SealedSecret can only be decrypted by the controller running in the target cluster, ensuring that sensitive data is not exposed in plain text. This aligns with GitOps principles by keeping all configuration, including secrets, version-controlled and declarative.

Answer

Store them in base64 encoded format in plain Git.

Answer

Leave them out of Git and manually inject them via kubectl.

Answer

Upload them to the cluster via the cloud provider's console.

Question 16

What is the key difference between Configuration as Code and Infrastructure as Code in the context of GitOps?

Accepted Answer

IaC defines the underlying resources, while Config as Code defines the application-level settings.. Infrastructure as Code (IaC) defines the underlying resources — VMs, networks, clusters, storage — while Configuration as Code defines application-level settings such as environment variables, feature flags, and service configuration. In GitOps, both are stored in Git, but they operate at different layers of the stack.

Answer

Configuration as Code is only for databases.

Answer

Config as Code is always written in YAML.

Answer

They are the same thing.

Question 17

Which tool provides the most native integration for managing Kubernetes manifests using Kustomize within a GitOps workflow?

Accepted Answer

Argo CD. Argo CD is purpose-built for GitOps and natively supports Kustomize as a first-class manifest source. Its repository server recognizes kustomization.yaml files and can render Kustomize overlays directly without external tooling. Terraform, Ansible, and Jenkins are general-purpose automation tools that require custom glue code to invoke Kustomize and do not provide continuous reconciliation of Kustomize-rendered manifests.

Answer

Terraform

Answer

Ansible

Answer

Jenkins

Question 18

In a GitOps pattern, how do you manage a rollback when an application deployment fails?

Accepted Answer

Revert the commit in Git and let the GitOps operator reconcile.. In GitOps, Git is the single source of truth for the desired state of the system. To roll back a failed deployment, you revert the offending commit in Git, which changes the desired state back to the last known good version. The GitOps operator (e.g., Argo CD or Flux) continuously reconciles the cluster to match Git, so it will automatically apply the rollback. This approach ensures that the rollback is version-controlled, auditable, and consistent with the declarative model.

Answer

Delete the pods and let the operator recreate them.

Answer

Stop the GitOps operator to prevent it from correcting the state.

Answer

Run 'kubectl rollout undo' on the deployment.

Question 19

When using a GitOps operator that performs 'image polling', what is the risk of using a 'latest' tag?

Accepted Answer

It makes rollbacks impossible because the 'latest' image may be different than what was deployed.. Using a 'latest' tag with a GitOps operator that performs image polling is risky because the tag is mutable — the image it points to can change without any change to the Git manifest. If a rollback is needed, the operator cannot guarantee that the 'latest' image it pulls is the same one that was previously deployed, making rollbacks unreliable and non-deterministic. This breaks the GitOps principle of immutable, versioned desired state.

Answer

It causes high latency in the cluster.

Answer

The GitOps operator cannot detect changes.

Answer

It consumes too much disk space.

Question 20

You are auditing a GitOps process. Which of the following is an indicator that the process is NOT truly following GitOps principles?

Accepted Answer

An administrator manually updates a Kubernetes Deployment manifest directly on the cluster.. GitOps requires that the Git repository serves as the single source of truth for the desired state of the system, with all changes flowing through Git and being automatically reconciled by an operator. Option D describes a manual, out-of-band change directly to the cluster, which bypasses Git entirely and breaks the declarative, version-controlled workflow. This is a clear violation because the live state can drift from the declared state without any audit trail or reconciliation trigger.

Answer

Secrets are encrypted in the Git repo.

Answer

The cluster automatically reconciles changes pushed to Git.

Answer

Developers use PRs to propose changes to the environment.