CGOA Related Practices Practice Test 1 — 15 Questions

Question 1

Why is 'Git' considered the 'source of truth' in GitOps?

Accepted Answer

Because it acts as the single point of record for the desired system state.. Git provides a clear, immutable, and auditable history of every change made to the system, which is essential for reproducibility.

Answer

Because Git stores all application logs.

Answer

Because it is the only tool that supports branching.

Answer

Because Git automatically runs the applications.

Question 2

In a GitOps environment, what is the main purpose of maintaining Infrastructure as Code?

Accepted Answer

To ensure that infrastructure can be defined, tracked, and automatically reconciled from Git.. IaC allows the entire infrastructure stack to be versioned, audited, and recreated reliably, mirroring the application deployment process.

Answer

To avoid using cloud provider dashboards.

Answer

To generate cost reports for the finance department.

Answer

To allow developers to log into servers and make changes.

Question 3

Your organization wants to implement DevSecOps by integrating security scanning into a GitOps pipeline. Where should the vulnerability scan happen to prevent insecure configurations from ever reaching the cluster?

Accepted Answer

During the CI phase, scanning the Kubernetes manifests for security misconfigurations before merging.. Shifting left means scanning code before it is applied to the cluster, ensuring the Git repository acts as a gatekeeper.

Answer

Only when an auditor requests a security report.

Answer

By running an automated script to delete pods that fail a security check.

Answer

As a post-deployment check using a Kubernetes admission controller.

Question 4

A company uses Terraform for IaC and Argo CD for application delivery. How should they manage the dependency between infrastructure provisioning and app deployment to ensure GitOps consistency?

Accepted Answer

Use Crossplane to represent infrastructure as Kubernetes objects, managing both IaC and apps via GitOps.. Using a tool like Crossplane or an orchestrator ensures that infrastructure and applications are synchronized through the same Git-based reconciliation loop.

Answer

Execute Terraform via a CI job that triggers Argo CD after completion.

Answer

Manually trigger Terraform runs before pushing new app manifests to Git.

Answer

Embed Terraform binary execution within a K8s deployment container.

Question 5

When mapping a traditional CI/CD pipeline to GitOps, what is the primary role of the CD tool?

Accepted Answer

Reconciling the running state of the cluster with the declarative state defined in Git.. In GitOps, the CD tool acts as a continuous reconciler that pulls changes from Git to match the cluster state.

Answer

Pushing binary artifacts to a server via SSH.

Answer

Pushing images to a container registry after a build.

Answer

Generating test reports for the QA team.

Question 6

You are debugging a drift in a GitOps environment. The cluster state differs from the Git repository. What is the most likely cause if you are using Flux?

Accepted Answer

A user performed a manual 'kubectl' command to modify a deployment.. Flux reconcilers periodically verify the cluster state; drift usually occurs when an external actor modifies the cluster directly or a manual change occurred.

Answer

The container registry is unreachable during a new image rollout.

Answer

The Git repository contains syntax errors in the YAML files.

Answer

The CI pipeline failed to run tests.

Question 7

Which practice represents the 'DevSecOps' aspect in a GitOps pipeline?

Accepted Answer

Enforcing policy constraints via OPA/Gatekeeper that validate manifests against security rules.. Policy-as-code tools like OPA/Gatekeeper allow for security policies to be versioned in Git and enforced automatically during the deployment process.

Answer

Conducting quarterly penetration tests.

Answer

Requiring a manual sign-off by a security officer for every deployment.

Answer

Storing secrets in plain text in the Git repository.

Question 8

A team is transitioning from traditional imperative scripts to declarative Configuration as Code. Which approach best satisfies the GitOps principle of using a desired state definition?

Accepted Answer

Storing Kubernetes YAML manifests in a Git repository and using an operator to synchronize them.. GitOps requires that the desired state be declared in a version-controlled repository to ensure traceability and auditability.

Answer

Using bash scripts triggered by a Jenkins build job to update environment variables.

Answer

Directly editing deployments via the 'kubectl edit' command.

Answer

Using an Ansible playbook to perform one-off configuration changes on existing servers.

Question 9

You are implementing a multi-environment strategy. Which Git branching strategy best supports GitOps?

Accepted Answer

Using dedicated directories for each environment within a single repository.. Environment-specific branches or directory-based separation (using Kustomize or Helm) allow for tracking changes across dev, staging, and prod independently.

Answer

Deleting the Git repository after each deployment to prevent tampering.

Answer

Using a single 'main' branch that is pushed to all environments simultaneously.

Answer

Creating a new repository for every single deployment.

Question 10

When implementing a CI/CD pipeline for GitOps, how should you handle image tag updates?

Accepted Answer

Using an automated agent that detects new images and commits the tag change back to the Git repo.. Automating image updates through a tool like Renovate or Argo CD Image Updater ensures the repository is kept in sync with the latest build artifacts.

Answer

Having the CD operator pull the 'latest' tag directly from the registry.

Answer

Manually updating the YAML file with the new image tag and committing to Git.

Answer

Triggering a shell script to update the cluster state directly from the CI pipeline.

Question 11

What is the primary benefit of using a pull-based GitOps operator compared to a push-based CI/CD system?

Accepted Answer

The cluster does not need inbound access from the CI pipeline.. Pull-based systems don't require the CI system to have credentials for the cluster, improving security and enabling autonomous reconciliation.

Answer

It eliminates the need for container registries.

Answer

You can use fewer Git branches.

Answer

The CI system runs faster.

Question 12

When configuring a GitOps pipeline, what should be done to manage sensitive data like API keys?

Accepted Answer

Use a tool like Sealed Secrets to encrypt them before committing to Git.. Secrets should be stored in an encrypted format (like Sealed Secrets or an external secret store) within Git so they remain secure while still being part of the declarative configuration.

Answer

Store them in base64 encoded format in plain Git.

Answer

Leave them out of Git and manually inject them via kubectl.

Answer

Upload them to the cluster via the cloud provider's console.

Question 13

What is the key difference between Configuration as Code and Infrastructure as Code in the context of GitOps?

Accepted Answer

IaC defines the underlying resources, while Config as Code defines the application-level settings.. Infrastructure as Code focuses on the underlying environment (VMs, networks), while Configuration as Code focuses on the software services and their settings.

Answer

Configuration as Code is only for databases.

Answer

Config as Code is always written in YAML.

Answer

They are the same thing.

Question 14

Which tool provides the most native integration for managing Kubernetes manifests using Kustomize within a GitOps workflow?

Accepted Answer

Argo CD. Argo CD has native, first-class support for Kustomize overlays, allowing for environment-specific customization without needing external tools.

Answer

Terraform

Answer

Ansible

Answer

Jenkins

Question 15

In a GitOps pattern, how do you manage a rollback when an application deployment fails?

Accepted Answer

Revert the commit in Git and let the GitOps operator reconcile.. Rolling back involves reverting the commit in Git, which the operator then detects and reconciles to return the cluster to the previous working state.

Answer

Delete the pods and let the operator recreate them.

Answer

Stop the GitOps operator to prevent it from correcting the state.

Answer

Run 'kubectl rollout undo' on the deployment.