CGOA Related Practices Practice Test 2 — 15 Questions

Question 1

When using a GitOps operator that performs 'image polling', what is the risk of using a 'latest' tag?

Accepted Answer

It makes rollbacks impossible because the 'latest' image may be different than what was deployed.. The 'latest' tag is mutable, meaning it can point to different code at different times, violating the GitOps principle of deterministic, reproducible deployments.

Answer

It causes high latency in the cluster.

Answer

The GitOps operator cannot detect changes.

Answer

It consumes too much disk space.

Question 2

You are auditing a GitOps process. Which of the following is an indicator that the process is NOT truly following GitOps principles?

Accepted Answer

An administrator manually updates a Kubernetes Deployment manifest directly on the cluster.. If a developer manually modifies a resource using kubectl, they are bypassing the Git source of truth, which is the definition of a GitOps violation.

Answer

Secrets are encrypted in the Git repo.

Answer

The cluster automatically reconciles changes pushed to Git.

Answer

Developers use PRs to propose changes to the environment.

Question 3

Which scenario demonstrates the most effective way to manage environment-specific configurations in a large-scale GitOps setup?

Accepted Answer

Creating environment-specific branches and using a templating tool to apply overrides.. Using a templating tool like Helm or Kustomize allows you to define a base application and apply patches for different environments without duplicating the entire manifest.

Answer

Storing all configurations in a single large YAML file.

Answer

Copying and pasting the entire manifest directory for each environment.

Answer

Ignoring environment differences and using the same values for everything.

Question 4

In the context of a CI/CD pipeline, where does the 'GitOps' bridge typically occur?

Accepted Answer

When the CI pipeline updates the manifest repository with the new image tag.. The bridge occurs when the CI tool finishes the build and updates the Git repository with the new state, which the GitOps CD operator then picks up.

Answer

When the operator triggers the build.

Answer

When the developer logs into the cluster.

Answer

When the Git repo is deleted.

Question 5

How does the GitOps pattern simplify the audit process for a regulatory environment?

Accepted Answer

It provides a clear audit trail in Git by linking every state change to a commit and a user.. Git history provides an immutable log of who changed what and when, serving as a complete audit trail for compliance teams.

Answer

It moves all audit logs to the cluster memory.

Answer

It requires manual documentation of every change.

Answer

It removes the need for logs.

Question 6

What is the most effective approach to handle 'secrets' in GitOps when you require strict compliance that mandates secrets never exist in plain text in the repo?

Accepted Answer

Use an external secret store that injects values into the cluster at runtime.. External Secrets Operator or HashiCorp Vault integration fetches secrets from a secure, external source and injects them into the cluster, so they are never in the Git repo.

Answer

Store secrets in an encrypted cloud storage bucket and manually map them.

Answer

Use standard Kubernetes secrets and hope for the best.

Answer

Use Sealed Secrets with a public key in Git.

Question 7

In a GitOps environment, what is the best strategy for managing external dependencies (like Helm charts)?

Accepted Answer

Pinning the version of the Helm chart in your Git repository.. Storing the specific version of the Helm chart in the GitOps configuration ensures that the deployment remains reproducible.

Answer

Always pulling the latest version from the remote Helm repository.

Answer

Ignoring the chart version and hoping it stays compatible.

Answer

Manually downloading the chart to every node.

Question 8

Which action should a developer take to deploy a new version of an application in a GitOps-based workflow?

Accepted Answer

Submit a pull request to the Git repository containing the configuration update.. The developer updates the manifest (e.g., image tag) in the Git repository and merges it, triggering the GitOps operator to update the cluster.

Answer

Wait for the automated CI/CD tool to trigger a redeployment.

Answer

Run 'kubectl apply' from their local machine.

Answer

Log into the Argo CD dashboard and click 'Deploy'.

Question 9

What is the primary function of an 'Admission Controller' in a GitOps-based DevSecOps workflow?

Accepted Answer

To validate and enforce policies on cluster resources before they are persisted.. Admission controllers act as a final gate, validating or mutating requests to the Kubernetes API to ensure they comply with organizational policies.

Answer

To build container images.

Answer

To monitor application logs for errors.

Answer

To trigger the CI/CD pipeline.

Question 10

Which of the following describes the 'Declarative' aspect of GitOps?

Accepted Answer

Defining the desired state in a YAML file.. Declarative means describing the 'what' (the final state) rather than the 'how' (the steps to achieve it).

Answer

Manually clicking buttons in a UI to scale a service.

Answer

Creating a list of commands to run in order.

Answer

Writing a shell script to upgrade a deployment.

Question 11

Why do you use a separate repository for application code and application manifests (deployment manifests) in GitOps?

Accepted Answer

To allow different teams to manage code and configuration independently and securely.. Separating the source code from the environment configuration allows for independent lifecycle management and improved security scoping.

Answer

It is required by the Kubernetes specification.

Answer

Because they are written in different languages.

Answer

It makes the CI/CD pipeline run faster.

Question 12

You are managing a global cluster setup with GitOps. How do you handle configuration that must be identical across all clusters while allowing for regional variations?

Accepted Answer

Using a base-overlay structure where the base contains common settings and overlays contain regional variations.. Base/overlay patterns (like Kustomize) allow you to define a common base and apply regional overlays to handle unique settings.

Answer

Only having one cluster.

Answer

Duplicating the configuration for every cluster.

Answer

Using global variables in a shell script to modify manifests.

Question 13

When mapping traditional CI/CD to GitOps, which component from the traditional world is often 'decommissioned' or replaced?

Accepted Answer

The imperative CD deployment scripts (e.g., shell scripts that run 'kubectl apply').. The 'deployment' logic in the traditional CI/CD server (like Jenkins/GitLab CI) is often replaced by the GitOps operator, which handles the deployment logic autonomously.

Answer

The container registry.

Answer

The build tool (e.g., Maven/npm).

Answer

The Git version control system.

Question 14

What is the primary role of the GitOps operator during the reconciliation phase?

Accepted Answer

Continuously checking if the cluster matches the desired state in Git.. The operator compares the actual state of the cluster with the desired state in Git and makes adjustments to match them.

Answer

Reporting the number of users connected to the cluster.

Answer

Deleting the Git repository to save space.

Answer

Compiling the application source code.

Question 15

You notice that your GitOps pipeline is stuck in a loop. What is the most likely cause?

Accepted Answer

The deployment process automatically commits changes back to the same Git branch that triggers the deployment.. A loop often occurs when the GitOps operator updates the cluster, and that update triggers a process that then modifies the Git repository, creating a feedback cycle.

Answer

The cluster is too small.

Answer

The Git repository contains a circular reference.

Answer

The container registry is offline.