CGOA Tooling Practice Test 1 — 15 Questions

Question 1

You are configuring Flux to manage a multi-tenant cluster. You need to ensure that specific namespaces only allow images from an internal registry. Which tool should you use to enforce this at admission time?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Kyverno. Kyverno is a Kubernetes-native policy engine that can restrict image registries via admission controllers.

Answer

ArgoCD Notifications

Answer

Sealed Secrets

Answer

Flux Image Automation Controller

Question 2

You are using ArgoCD and need to ensure that secret values stored in Git via Sealed Secrets are decrypted only within the target cluster. What component performs the actual decryption of a SealedSecret resource?

Accepted Answer

Sealed Secrets controller. The Sealed Secrets controller running in the target cluster holds the private key required to decrypt the SealedSecret into a standard Kubernetes Secret.

Answer

GitOps CLI (kubeseal)

Answer

Kubernetes API Server

Answer

ArgoCD Application controller

Question 3

You are using OPA Gatekeeper with GitOps. You want to prevent any deployment that does not have an 'owner' label. Where should this policy be applied to ensure it is enforced for all GitOps-driven changes?

Accepted Answer

Validating Admission Webhook. Validating admission webhooks (which Gatekeeper uses) enforce policies regardless of the source of the change, whether manual or GitOps.

Answer

Git pre-receive hook

Answer

Flux Source Controller

Answer

ArgoCD AppProject

Question 4

When migrating from ArgoCD to Flux, you want to replicate the 'Sync Waves' behavior. Which Flux feature provides equivalent control over the order of resource reconciliation?

Accepted Answer

dependsOn. Flux uses the 'dependsOn' field in the Kustomization resource to define ordered dependencies between objects.

Answer

Post-sync hooks

Answer

Sync waves

Answer

Reconciliation intervals

Question 5

Which GitOps tool relies primarily on a pull-based model utilizing the 'Source Controller' and 'Kustomization' custom resources?

Accepted Answer

Flux. Flux v2 is architected around specialized controllers, including the Source Controller and Kustomization Controller.

Answer

ArgoCD

Answer

Terraform

Answer

Helm

Question 6

Your organization requires that all Kubernetes manifest changes be signed and encrypted before being pushed to Git. Which tool is primarily designed for this 'at-rest' encryption approach?

Accepted Answer

Mozilla SOPS. Mozilla SOPS is the standard tool for encrypting sensitive values within manifest files (like YAML) before they are committed to Git.

Answer

Kyverno

Answer

Sealed Secrets

Answer

HashiCorp Vault

Question 7

In an ArgoCD environment, you notice that a specific set of resources is being ignored during sync. What field in the 'argocd-cm' ConfigMap or the Application manifest is likely responsible?

Accepted Answer

ignoreDifferences. The 'ignoreDifferences' field allows users to exclude specific fields or resource paths from the sync reconciliation process.

Answer

syncPolicy.automated.prune

Answer

resource.exclusions

Answer

selfHeal

Question 8

You are using ArgoCD to deploy an application. You notice that the Application status remains 'OutOfSync' even after manual refreshes. Which feature should you examine to determine if the controller is failing to reach the cluster API?

Accepted Answer

ArgoCD App Details event log. The 'App Details' view under the 'Sync' tab or the 'Events' log in the ArgoCD UI provides specific error messages regarding API connectivity and reconciliation failures.

Answer

Project settings

Answer

ApplicationSet controller logs

Answer

Git repository webhooks

Question 9

Which of the following is a key advantage of using a 'pull' based GitOps model (like Flux or ArgoCD) over a 'push' based CI/CD pipeline?

Accepted Answer

Elimination of external cluster credentials in CI. Pull models don't require the GitOps tool to have cluster admin credentials stored in the CI system, enhancing security.

Answer

Faster build times

Answer

Automatic unit testing

Answer

No need for Git

Question 10

You are using Flux with Kustomize. You want to apply different configurations for production and staging, but both use the same base manifests. Which Kustomize feature allows this?

Accepted Answer

Overlays. Kustomize overlays allow patching the base manifests with environment-specific configurations.

Answer

Post-build variables

Answer

Flux Kustomization resource

Answer

Helm charts

Question 11

You are managing secrets using SOPS with Age. You notice that Flux cannot decrypt the files. What is the most likely cause?

Accepted Answer

Missing private key secret in the flux-system namespace. Flux needs access to the private key (stored as a Kubernetes Secret) to decrypt SOPS-encrypted files during reconciliation.

Answer

SOPS version mismatch

Answer

Network latency

Answer

Incorrect git branch

Question 12

You have a large ArgoCD installation and want to limit the blast radius. Which feature allows you to restrict which namespaces an application can deploy to?

Accepted Answer

AppProject. AppProject resources are used to group applications and define strict cluster and namespace-level destination restrictions.

Answer

ClusterRoleBinding

Answer

Sync policies

Answer

ApplicationSet

Question 13

An ArgoCD application is configured with 'SelfHeal' set to true. If a developer manually modifies a Deployment's replica count via kubectl, what happens?

Accepted Answer

ArgoCD reverts the change to match the Git state. With self-heal enabled, ArgoCD detects the discrepancy between the live state and Git state and automatically overwrites the live state with the Git version.

Answer

The change is permanently accepted

Answer

ArgoCD flags the app as 'OutOfSync' but waits for manual intervention

Answer

The manual change is merged into Git

Question 14

You are using ArgoCD and need to inject a value into a manifest that is not present in Git, such as a temporary credential. Which feature would you use to do this dynamic injection?

Accepted Answer

Helm values override in Application manifest. ArgoCD supports 'Helm parameters' or 'Kustomize vars', but specifically for dynamic external values, the 'argocd-vault-plugin' or similar sidecar approaches are common, but using 'Application parameters' is the core supported way to override Helm values.

Answer

Secret injection controller

Answer

Resource hooks

Answer

Git commit override

Question 15

When troubleshooting a Kyverno policy, which command should you use to check if a specific resource complies with the policy?

Accepted Answer

kyverno apply. The 'kyverno apply' command allows testing a policy against a local manifest to verify compliance before deployment.

Answer

kubectl get policies

Answer

kyverno test

Answer

kubectl describe policy