CGOA Tooling Practice Test 2 — 15 Questions

Question 1

You have a large ArgoCD installation and want to limit the blast radius. Which feature allows you to restrict which namespaces an application can deploy to?

Accepted Answer

AppProject. AppProject is the ArgoCD custom resource that defines a logical grouping of applications with explicit boundaries: permitted source repositories, permitted destination clusters, and permitted destination namespaces. By setting spec.destinations with a namespace allow-list (or wildcard restrictions), the AppProject enforces that any Application assigned to it can only deploy into those namespaces, directly limiting blast radius. This is the documented mechanism for multi-tenant isolation in ArgoCD.

Answer

ClusterRoleBinding

Answer

Sync policies

Answer

ApplicationSet

Question 2

An ArgoCD application is configured with 'SelfHeal' set to true. If a developer manually modifies a Deployment's replica count via kubectl, what happens?

Accepted Answer

ArgoCD reverts the change to match the Git state. When ArgoCD's SelfHeal is enabled, it automatically reconciles the live cluster state with the desired state in Git. If a developer manually changes a Deployment's replica count via kubectl, ArgoCD detects the drift and reverts the change to match Git. This ensures the Git repository remains the single source of truth.

Answer

The change is permanently accepted

Answer

ArgoCD flags the app as 'OutOfSync' but waits for manual intervention

Answer

The manual change is merged into Git

Question 3

When troubleshooting a Kyverno policy, which command should you use to check if a specific resource complies with the policy?

Accepted Answer

kyverno apply. The 'kyverno apply' command is used to apply Kyverno policies to a given resource or set of resources and check compliance. It simulates policy enforcement and reports whether the resource complies with the specified policies. This is the correct command for troubleshooting whether a specific resource adheres to a policy.

Answer

kubectl get policies

Answer

kyverno test

Answer

kubectl describe policy

Question 4

What is the purpose of the 'SealedSecrets' custom resource?

Accepted Answer

Encrypting sensitive data for Git storage. SealedSecrets is a Kubernetes controller that encrypts Secret manifests with a cluster-specific public key so the ciphertext can be safely committed to Git. Only the controller in the target cluster, holding the private key, can decrypt the SealedSecret back into a regular Secret. This enables GitOps workflows where secrets live in version control without exposing plaintext.

Answer

Backing up Kubernetes secrets

Answer

Managing cluster-wide RBAC

Answer

Encrypting traffic between pods

Question 5

You are debugging an ArgoCD sync failure. You find the 'Sync Status' is 'Failed'. Where is the most detailed error information located?

Accepted Answer

Sync Result in Application UI. The Sync Result in the Application UI provides the most detailed error information for a failed sync. It shows the exact error message from the sync operation, including which resource failed, the reason (e.g., validation error, conflict, or apply failure), and often the full output from kubectl apply. This is the primary place to diagnose sync failures because it aggregates the results of the sync attempt.

Answer

ApplicationSet status

Answer

Git log

Answer

ArgoCD repo server logs

Question 6

Which of these is a primary reason for using Helm charts in a GitOps workflow?

Accepted Answer

Templating and packaging complex applications. Helm charts are used in GitOps workflows primarily for templating and packaging complex applications (D). Helm allows you to define Kubernetes resources as parameterized templates, making it easy to manage and version application configurations in Git. This aligns with GitOps principles where the desired state is stored declaratively in Git and applied automatically.

Answer

Encrypting all traffic

Answer

Replacing the need for Kubernetes

Answer

Creating Git commits automatically

Question 7

Which GitOps tool provides a dedicated CLI called 'argocd'?

Accepted Answer

ArgoCD. ArgoCD ships with a dedicated command-line interface called `argocd`, used to log in, manage applications, sync, and inspect cluster state. The CLI is a first-class part of the ArgoCD project and is documented alongside the web UI. This is a defining characteristic of ArgoCD among GitOps tools.

Answer

Kyverno

Answer

Flux

Answer

Helm

Question 8

You are using Flux and want to pause reconciliation for a specific application without deleting the resource. Which field should you modify?

Accepted Answer

suspend: true. Flux CRDs such as GitRepository, Kustomization, and HelmRelease expose a 'suspend' boolean field. Setting spec.suspend: true tells the controller to stop reconciling that object without deleting it, so the last-applied state remains in the cluster. Removing the field (or setting it to false) resumes reconciliation.

Answer

interval: 0

Answer

reconcile: false

Answer

pause: true

Question 9

You have a Git repository that contains multiple Kustomizations. You want Flux to update all of them based on a single trigger. How should you structure the repository?

Accepted Answer

Using a base directory and multiple overlays. Using a base directory and multiple overlays is the correct approach because Kustomize's base/overlay pattern allows a single Git repository to contain multiple Kustomizations that share common resources. When Flux detects a change in the repository, it can trigger reconciliation for all Kustomizations that reference the same base or overlays, enabling a single trigger to update all of them. This structure promotes DRY principles and simplifies management of multiple environments or variants from one source of truth.

Answer

Using one Git repo per application

Answer

Disabling Kustomize

Answer

Combining all manifests into one large file

Question 10

In ArgoCD, what does the 'Revision' field in an Application manifest represent?

Accepted Answer

The specific git hash or branch being tracked. In an ArgoCD Application manifest, spec.source.targetRevision (commonly surfaced as the Revision field) identifies the exact Git commit SHA, branch, or tag that ArgoCD tracks for the desired state. It is the pointer into the source repository, not a counter or a version of ArgoCD or Helm. When ArgoCD syncs, it resolves this revision to a concrete commit and compares it against the live cluster state.

Answer

The number of times the app has synced

Answer

The ArgoCD version

Answer

The version of the Helm chart

Question 11

When using OPA Gatekeeper for policy enforcement, what resource is used to define the actual logic of the policy?

Accepted Answer

ConstraintTemplate. In OPA Gatekeeper, a ConstraintTemplate defines the Rego policy logic and the schema of the constraint's parameters. It is a cluster-scoped custom resource that, when created, causes Gatekeeper to generate a new CRD (the constraint kind). You then instantiate that kind as a Constraint to actually enforce the policy on selected resources. The ConstraintTemplate is where the actual policy logic lives.

Answer

AdmissionRule

Answer

GatekeeperConfig

Answer

PolicyDefinition

Question 12

You are using ArgoCD and need to ensure that a Helm chart is rendered correctly with a specific set of values. Where do you specify these values in the ArgoCD Application resource?

Accepted Answer

spec.source.helm.values. In an ArgoCD Application resource, Helm values are specified under spec.source.helm.values, which is the field ArgoCD reads when rendering the chart. This allows you to override chart defaults with a specific set of values. The other paths do not exist in the Application CRD.

Answer

spec.syncPolicy.values

Answer

spec.parameters

Answer

spec.destination.values

Question 13

Which THREE of the following are valid components of the ArgoCD architecture?

Accepted Answer

API Server. The ArgoCD architecture is composed of three main components: the API Server (A), which exposes the gRPC/REST API used by the Web UI, CLI, and CI systems and handles authentication, RBAC, and application management; the Application Controller (B), which continuously monitors running applications and compares live state against the desired state defined in Git (a Kubernetes controller that performs sync/health assessment); and the Repo Server (C), which maintains a local cache of Git repositories and generates Kubernetes manifests by rendering Helm charts, Kustomize, or plain YAML. Options D (Source Controller) and E (Kustomization Controller) are not ArgoCD components — Source Controller is part of Flux (Flux's source-controller), and Kustomization Controller is also a Flux component (kustomize-controller), so neither belongs to the ArgoCD architecture.

Answer

Source Controller

Answer

Kustomization Controller

Question 14

When configuring Kyverno policies to secure a cluster, which TWO of the following actions can a policy perform?

Accepted Answer

Enforce policies by blocking requests. Kyverno is a Kubernetes-native policy engine that operates as a validating and mutating admission controller, so option A is correct: a policy in Enforce mode causes the admission webhook to reject (block) any request that violates the rule, returning a denial to the API server. Option E is also correct: Kyverno policies can run in Audit mode, where violations are not blocked but are recorded as PolicyReports (and ClusterPolicyReports) that surface non-compliant resources for review. The remaining options are outside Kyverno's scope: provisioning new clusters (B) is done by tools like Cluster API, kubeadm, or Terraform; managing Git repository webhooks (C) belongs to Git hosting platforms or CI/CD systems such as GitHub/GitLab; and automatically upgrading cluster nodes (D) is handled by node lifecycle tooling like kubeadm upgrade, Cluster API, or managed-node upgrade features, not by a policy engine.

Answer

Provision new clusters

Answer

Manage Git repository webhooks

Answer

Automatically upgrade cluster nodes

Question 15

You are debugging a flux-system reconciliation loop. You notice the Kustomization is stuck in 'Retrying'. What command shows the current status and reason for the failure?

Accepted Answer

flux get kustomizations. `flux get kustomizations` is the canonical Flux CLI command that lists every Kustomization with its READY state, STATUS message, and last-applied revision, and when a Kustomization is stuck in 'Retrying' the STATUS column shows the exact error (e.g., a failed apply, a missing dependency, or a source-not-ready condition). It queries the Flux CRDs directly and is the fastest way to see the reconciliation reason without digging into controller logs.

Answer

flux logs

Answer

kubectl describe kustomization

Answer

flux wait