CGOA Related Practices Practice Test 2 — 15 Questions

Question 1

What is the key difference between Configuration as Code and Infrastructure as Code in the context of GitOps?

Accepted Answer

IaC defines the underlying resources, while Config as Code defines the application-level settings.. Infrastructure as Code (IaC) defines the underlying resources — VMs, networks, clusters, storage — while Configuration as Code defines application-level settings such as environment variables, feature flags, and service configuration. In GitOps, both are stored in Git, but they operate at different layers of the stack.

Answer

Configuration as Code is only for databases.

Answer

Config as Code is always written in YAML.

Answer

They are the same thing.

Question 2

Which tool provides the most native integration for managing Kubernetes manifests using Kustomize within a GitOps workflow?

Accepted Answer

Argo CD. Argo CD is purpose-built for GitOps and natively supports Kustomize as a first-class manifest source. Its repository server recognizes kustomization.yaml files and can render Kustomize overlays directly without external tooling. Terraform, Ansible, and Jenkins are general-purpose automation tools that require custom glue code to invoke Kustomize and do not provide continuous reconciliation of Kustomize-rendered manifests.

Answer

Terraform

Answer

Ansible

Answer

Jenkins

Question 3

In a GitOps pattern, how do you manage a rollback when an application deployment fails?

Accepted Answer

Revert the commit in Git and let the GitOps operator reconcile.. In GitOps, Git is the single source of truth for the desired state of the system. To roll back a failed deployment, you revert the offending commit in Git, which changes the desired state back to the last known good version. The GitOps operator (e.g., Argo CD or Flux) continuously reconciles the cluster to match Git, so it will automatically apply the rollback. This approach ensures that the rollback is version-controlled, auditable, and consistent with the declarative model.

Answer

Delete the pods and let the operator recreate them.

Answer

Stop the GitOps operator to prevent it from correcting the state.

Answer

Run 'kubectl rollout undo' on the deployment.

Question 4

When using a GitOps operator that performs 'image polling', what is the risk of using a 'latest' tag?

Accepted Answer

It makes rollbacks impossible because the 'latest' image may be different than what was deployed.. Using a 'latest' tag with a GitOps operator that performs image polling is risky because the tag is mutable — the image it points to can change without any change to the Git manifest. If a rollback is needed, the operator cannot guarantee that the 'latest' image it pulls is the same one that was previously deployed, making rollbacks unreliable and non-deterministic. This breaks the GitOps principle of immutable, versioned desired state.

Answer

It causes high latency in the cluster.

Answer

The GitOps operator cannot detect changes.

Answer

It consumes too much disk space.

Question 5

You are auditing a GitOps process. Which of the following is an indicator that the process is NOT truly following GitOps principles?

Accepted Answer

An administrator manually updates a Kubernetes Deployment manifest directly on the cluster.. GitOps requires that the Git repository serves as the single source of truth for the desired state of the system, with all changes flowing through Git and being automatically reconciled by an operator. Option D describes a manual, out-of-band change directly to the cluster, which bypasses Git entirely and breaks the declarative, version-controlled workflow. This is a clear violation because the live state can drift from the declared state without any audit trail or reconciliation trigger.

Answer

Secrets are encrypted in the Git repo.

Answer

The cluster automatically reconciles changes pushed to Git.

Answer

Developers use PRs to propose changes to the environment.

Question 6

In the context of a CI/CD pipeline, where does the 'GitOps' bridge typically occur?

Accepted Answer

When the CI pipeline updates the manifest repository with the new image tag.. The GitOps bridge in a CI/CD pipeline occurs when the CI pipeline completes building and testing, then updates the manifest repository (e.g., a Git repo containing Kubernetes YAML) with the new image tag. This triggers the GitOps operator to reconcile the cluster to the new desired state.

Answer

When the operator triggers the build.

Answer

When the developer logs into the cluster.

Answer

When the Git repo is deleted.

Question 7

How does the GitOps pattern simplify the audit process for a regulatory environment?

Accepted Answer

It provides a clear audit trail in Git by linking every state change to a commit and a user.. GitOps simplifies audits because every change to the system is made via a Git commit, which records who made the change, when, and what exactly changed. This creates an immutable, traceable audit trail that can be reviewed and verified, satisfying regulatory requirements for change control and accountability.

Answer

It moves all audit logs to the cluster memory.

Answer

It requires manual documentation of every change.

Answer

It removes the need for logs.

Question 8

What is the most effective approach to handle 'secrets' in GitOps when you require strict compliance that mandates secrets never exist in plain text in the repo?

Accepted Answer

Use an external secret store that injects values into the cluster at runtime.. For strict compliance that mandates secrets never exist in plain text in the repo, the most effective approach is an external secret store (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) that injects values into the cluster at runtime via an operator like External Secrets Operator or Secrets Store CSI Driver. The Git repo only contains references (e.g., ExternalSecret CRs), never the secret material itself, satisfying the compliance requirement.

Answer

Store secrets in an encrypted cloud storage bucket and manually map them.

Answer

Use standard Kubernetes secrets and hope for the best.

Answer

Use Sealed Secrets with a public key in Git.

Question 9

In a GitOps environment, what is the best strategy for managing external dependencies (like Helm charts)?

Accepted Answer

Pinning the version of the Helm chart in your Git repository.. Pinning the Helm chart version in Git ensures the exact chart revision is declared as code, so the GitOps operator reconciles a deterministic, reproducible state. This makes deployments idempotent, enables rollback by reverting the Git commit, and prevents an upstream chart maintainer from silently changing behaviour. Version pinning is the GitOps equivalent of locking dependencies in a package manager.

Answer

Always pulling the latest version from the remote Helm repository.

Answer

Ignoring the chart version and hoping it stays compatible.

Answer

Manually downloading the chart to every node.

Question 10

Which action should a developer take to deploy a new version of an application in a GitOps-based workflow?

Accepted Answer

Submit a pull request to the Git repository containing the configuration update.. In a GitOps workflow, Git is the single source of truth, so any change to application state — including a new version — must be expressed as a commit or pull request to the configuration repository. The CD controller then detects the change and reconciles the cluster. This makes the PR the correct deployment trigger, providing review, audit trail, and rollback via Git history.

Answer

Wait for the automated CI/CD tool to trigger a redeployment.

Answer

Run 'kubectl apply' from their local machine.

Answer

Log into the Argo CD dashboard and click 'Deploy'.

Question 11

What is the primary function of an 'Admission Controller' in a GitOps-based DevSecOps workflow?

Accepted Answer

To validate and enforce policies on cluster resources before they are persisted.. Admission Controllers are Kubernetes API server plugins that intercept requests to create, modify, or delete resources after authentication/authorization but before the object is persisted to etcd. In a GitOps DevSecOps workflow, they enforce policy-as-code (e.g., OPA Gatekeeper, Kyverno) so that only compliant manifests—matching what Git declares—ever reach the cluster. This makes them the enforcement point for security guardrails, not a build or monitoring tool.

Answer

To build container images.

Answer

To monitor application logs for errors.

Answer

To trigger the CI/CD pipeline.

Question 12

Which of the following describes the 'Declarative' aspect of GitOps?

Accepted Answer

Defining the desired state in a YAML file.. Declarative configuration means you describe the desired end state (what the system should look like) rather than the steps to reach it (how to get there). Defining the desired state in a YAML manifest — e.g., a Deployment with replicas: 3 — is the canonical declarative approach in GitOps, and the controller continuously reconciles actual state to match it.

Answer

Manually clicking buttons in a UI to scale a service.

Answer

Creating a list of commands to run in order.

Answer

Writing a shell script to upgrade a deployment.

Question 13

Why do you use a separate repository for application code and application manifests (deployment manifests) in GitOps?

Accepted Answer

To allow different teams to manage code and configuration independently and securely.. Separating application code from deployment manifests lets different teams own their respective concerns: developers control code and CI, while platform or ops teams control deployment configuration, environment-specific values, and security policies. This separation also enforces least privilege — developers may not need write access to production manifests, and auditors can review config changes independently of code changes.

Answer

It is required by the Kubernetes specification.

Answer

Because they are written in different languages.

Answer

It makes the CI/CD pipeline run faster.

Question 14

You are managing a global cluster setup with GitOps. How do you handle configuration that must be identical across all clusters while allowing for regional variations?

Accepted Answer

Using a base-overlay structure where the base contains common settings and overlays contain regional variations.. A base-overlay structure (as implemented by Kustomize) lets you define shared configuration once in a base directory and layer cluster- or region-specific patches in overlays, so identical settings stay DRY while regional variations are expressed as targeted overrides. This is the canonical GitOps pattern for multi-cluster fleets because it keeps a single source of truth for common config and isolates divergence to small, reviewable overlay files.

Answer

Only having one cluster.

Answer

Duplicating the configuration for every cluster.

Answer

Using global variables in a shell script to modify manifests.

Question 15

When mapping traditional CI/CD to GitOps, which component from the traditional world is often 'decommissioned' or replaced?

Accepted Answer

The imperative CD deployment scripts (e.g., shell scripts that run 'kubectl apply').. In GitOps, the CD mechanism shifts from imperative push-based scripts (e.g., 'kubectl apply' in a Jenkins job) to a declarative pull-based controller (Flux/Argo CD) that continuously reconciles cluster state with Git. The imperative CD deployment scripts are therefore decommissioned because the GitOps operator replaces their role entirely. The build tool, container registry, and Git itself remain essential parts of the pipeline.

Answer

The container registry.

Answer

The build tool (e.g., Maven/npm).

Answer

The Git version control system.