CGOA Tooling Practice Test 3 — 15 Questions

Question 1

Which THREE of the following are common methods for managing secrets in a GitOps workflow?

Accepted Answer

External Secrets Operator. The External Secrets Operator (A) is correct because it syncs secrets from external secret managers (e.g., AWS Secrets Manager, HashiCorp Vault) into Kubernetes Secrets, keeping the source of truth outside Git while still enabling GitOps reconciliation. Sealed Secrets (B) is correct because it uses asymmetric encryption so that encrypted SealedSecret resources can be safely committed to Git and decrypted only by the controller in the cluster. Mozilla SOPS (C) is correct because it encrypts values within YAML/JSON files using KMS, age, or PGP keys, allowing encrypted secret manifests to be stored in Git and decrypted during the GitOps pipeline. Committing raw Kubernetes Secret YAMLs (D) is not acceptable because base64 encoding is not encryption, so credentials would be exposed in the repository. Hardcoding credentials in Dockerfiles (E) is not acceptable because it bakes plaintext secrets into image layers, exposing them to anyone with image access and violating secret-management best practices.

Answer

Committing raw Kubernetes Secret YAMLs

Answer

Hardcoding credentials in Dockerfiles

Question 2

When evaluating ArgoCD vs Flux, which TWO of the following are distinct advantages of using Flux?

Accepted Answer

Modular, controller-based architecture. Option D is correct because Flux is built as a set of independent Kubernetes controllers (source-controller, kustomize-controller, helm-controller, notification-controller), each with a single responsibility, which allows operators to install only the components they need and to scale or upgrade them independently — a modular design that contrasts with ArgoCD's more monolithic application-server model. Option E is correct because Flux natively reconciles multiple Git repositories through multiple GitRepository sources, each watched by its own Kustomization or HelmRelease, so a single Flux installation can continuously reconcile many repos without extra tooling. The unmarked options do not belong: A and B describe ArgoCD's strengths, since ArgoCD ships a built-in web UI with graphical RBAC management, whereas Flux is CLI/GitOps-centric and configures RBAC through Kubernetes manifests; C is also an ArgoCD feature, as ArgoCD provides visual sync waves and health status in its dashboard, while Flux expresses ordering via dependsOn and health checks rather than a graphical sync-wave view.

Answer

Built-in web-based graphical dashboard

Answer

RBAC managed via UI

Answer

Visual sync waves

Question 3

In a GitOps workflow, what is the best way to handle a configuration that must be different for production versus development clusters?

Accepted Answer

Kustomize overlays. Kustomize overlays let you maintain a single base set of manifests and apply environment-specific patches (replica counts, resource limits, image tags, ConfigMaps) via overlays for dev, staging, and prod. This keeps configuration DRY, reviewable in Git, and avoids drift, which is exactly what GitOps requires. ArgoCD and Flux both natively support Kustomize, making overlays the canonical pattern for environment differentiation.

Answer

Copy-pasting the manifest files

Answer

Using environment variables

Answer

Running multiple ArgoCD instances

Question 4

Which TWO of the following are valid ways to trigger a sync in ArgoCD?

Accepted Answer

Clicking 'Sync' in the ArgoCD UI. Option B is correct because the ArgoCD web UI provides a 'Sync' button on each Application that triggers an immediate synchronization of the desired manifests from Git to the target cluster. Option C is correct because ArgoCD supports Git webhooks (e.g., GitHub, GitLab, Bitbucket) that notify the argocd-server when a repository changes, allowing automated sync to be triggered without manual intervention. Option A is incorrect because sending a kill signal to the controller would terminate the process rather than initiate a sync, and ArgoCD does not interpret OS signals as sync triggers. Option D is incorrect because deleting the Git repository removes the source of truth and would cause sync failures, not trigger a sync. Option E is incorrect because restarting the API server only restarts the ArgoCD API component; it does not itself initiate an application sync.

Answer

Sending a kill signal to the controller

Answer

Deleting the Git repository

Answer

Restarting the API server

Question 5

Which TWO of the following are key features of the Flux Kustomization controller?

Accepted Answer

Reconciling Kubernetes manifests. Option A is correct because the Flux Kustomization controller's core job is to reconcile Kubernetes manifests from a source (such as a GitRepository or OCIRepository) into the cluster, applying them and continuously correcting drift to match the desired state. Option C is correct because Flux Kustomization supports post-build variable substitution, where placeholders like ${VAR} in the manifests are replaced using values from ConfigMaps/Secrets referenced in the spec.postBuild.substituteFrom field before the resources are applied. The unmarked options do not belong: Flux has no direct Jenkins integration (B), it does not host a private Git server (D) — it only consumes sources via GitRepository/OCIRepository — and it does not manage container image build pipelines (E), which is the role of tools like Tekton or CI systems rather than the Kustomization controller.

Answer

Direct integration with Jenkins

Answer

Hosting a private Git server

Answer

Managing container image build pipelines

Question 6

When using Kyverno, which THREE of the following can be used to validate Kubernetes resources?

Accepted Answer

Conditional logic (if/then). Kyverno validates Kubernetes resources through declarative policy rules, and option C (conditional logic (if/then)) is correct because Kyverno supports `if`/`else` conditional blocks within rules to evaluate resource attributes and conditionally apply validation behavior. Option D (pattern matching) is correct because Kyverno's `pattern` and `anyPattern` match blocks perform structural, wildcard-based matching against resource manifests to enforce required fields and values. Option E (JMESPath expressions) is correct because Kyverno uses JMESPath in `preconditions`, `deny` conditions, and variable substitution to query and evaluate fields within the admission request object. Options A (SQL queries) and B (Bash scripting) are not part of Kyverno's policy language; Kyverno policies are YAML-based and do not execute SQL or shell scripts for validation.

Answer

SQL queries

Answer

Bash scripting

Question 7

Which TWO of the following are common GitOps challenges?

Accepted Answer

Drift between Git and live state. Option A is correct because a core GitOps challenge is configuration drift — the live cluster state diverging from the desired state declared in Git — which occurs when changes are made directly to the cluster (e.g., via kubectl) or when reconciliation fails, requiring continuous sync tools like Argo CD or Flux to detect and remediate it. Option D is correct because Git repositories are plaintext and version-controlled, so storing Kubernetes Secrets, credentials, and tokens directly in Git exposes sensitive data; teams must adopt solutions such as Sealed Secrets, SOPS, External Secrets Operator, or HashiCorp Vault to manage secrets securely. Option B is not a GitOps challenge because Git is the foundational prerequisite of GitOps — the entire model depends on a Git repository as the single source of truth, so its absence is a setup failure rather than a common operational challenge. Option C is not a GitOps-specific challenge because having many developers is a general team-scaling concern, and Git's branching, pull-request, and review workflows are specifically designed to handle large contributor bases. Option E is not a challenge because documentation volume is unrelated to GitOps mechanics; if anything, GitOps improves traceability through commit history and declarative manifests.

Answer

Lack of Git repository

Answer

Too many developers

Answer

Too much documentation

Question 8

Which TWO of the following are true about ArgoCD ApplicationSets?

Accepted Answer

They support multi-cluster generators. Option A is correct because ApplicationSets provide generators such as the Cluster generator, which enumerates clusters registered in ArgoCD (via cluster Secrets) and produces one Application per cluster, enabling true multi-cluster deployments. Option D is correct because an ApplicationSet controller renders a template against generator output to automatically create, update, and delete ArgoCD Application resources, removing the need to hand-write each Application manifest. Option B is wrong since ApplicationSets are explicitly designed to target many clusters, not just the local one. Option C is wrong because ApplicationSets only generate Application CRs; image building is handled by CI tools like Jenkins, GitLab CI, or Tekton, not ArgoCD. Option E is wrong because ApplicationSets still rely on Git (or another generator source) as the desired-state source of truth and do not replace it.

Answer

They are only for local clusters

Answer

They handle container image builds

Answer

They replace the need for Git

Question 9

Which THREE of the following are essential tasks when implementing SOPS with GitOps?

Accepted Answer

Configuring the KMS or local key (e.g., Age). Option C is correct because SOPS needs a key source to encrypt/decrypt data: either a cloud KMS (AWS KMS, GCP KMS, Azure Key Vault) or a local key such as an Age keypair, and this must be configured before any SOPS operation works. Option D is correct because in a GitOps flow the cluster-side controller (e.g., Flux's kustomize-controller or Argo CD) must be able to decrypt at apply time, so the private key (Age identity or KMS credentials) has to be mounted into the cluster as a Secret. Option E is correct because the .sops.yaml file defines the creation rules that map file paths to the KMS keys or Age recipients used for encryption, ensuring consistent, reproducible encryption across the repository. Option A is not essential: Git LFS is a storage optimization for large binaries and is unrelated to SOPS, which encrypts values in place within YAML/JSON files. Option B is not essential: SOPS decryption is performed natively by the GitOps controller (or the sops binary), so a custom CI/CD build step to decrypt is unnecessary and would actually break the GitOps principle of the cluster reconciling encrypted manifests directly.

Answer

Enabling Git LFS for encrypted files

Answer

Running a custom CI/CD build to decrypt

Question 10

Which THREE of the following items are commonly found in a Flux 'GitRepository' manifest?

Accepted Answer

Git reference (branch/tag). Option A (Git reference such as branch/tag) is correct because a Flux GitRepository manifest uses the spec.ref field to specify which branch, tag, or commit (e.g., ref: {branch: main}) the source controller should track. Option B (Reconciliation interval) is correct because the manifest includes spec.interval, which tells the source-controller how often to poll the Git remote for changes (e.g., interval: 1m). Option D (Repository URL) is correct because spec.url is a required field that points to the Git repository (e.g., https://github.com/org/repo.git or ssh://git@github.com/org/repo.git). Option C (Kubernetes node labels) is not part of a GitRepository manifest; node labels belong to Node objects and are unrelated to source definitions. Option E (Database password) is not included; secrets like credentials are referenced indirectly via spec.secretRef, and a plaintext password would never appear in the manifest.

Answer

Kubernetes node labels

Answer

Database password

Question 11

Which TWO of the following tools allow for GitOps policy enforcement?

Accepted Answer

OPA Gatekeeper. OPA Gatekeeper (A) is correct because it is a Kubernetes admission controller that enforces policies written in Rego, allowing GitOps pipelines to validate and reject non-compliant manifests before they are applied to the cluster. Kyverno (E) is also correct because it provides Kubernetes-native policy enforcement via validating, mutating, and generating admission rules, which integrates with GitOps workflows to ensure only policy-compliant resources are deployed. Helm (B) is a package manager for templating and deploying Kubernetes manifests, not a policy enforcement engine. ArgoCD (C) and Flux (D) are GitOps continuous delivery tools that sync cluster state with Git, but they do not themselves enforce policy; they rely on tools like Gatekeeper or Kyverno for that purpose.

Answer

Helm

Answer

ArgoCD

Answer

Flux

Question 12

When using SOPS with Age, which THREE of the following are true regarding key management?

Accepted Answer

Multiple public keys can be added to one SOPS file. Option A is correct because SOPS supports encrypting the data key to multiple recipients, so several Age public keys can be listed in the same SOPS file, allowing any corresponding private key holder to decrypt. Option B is correct because the Age private key is the secret that actually decrypts the file, so it must be stored securely (for example, as a Kubernetes Secret with restricted RBAC) to prevent unauthorized decryption. Option E is correct because Age is an asymmetric encryption scheme: the public key is used to encrypt/wrap the data key, while the matching private key is required for decryption. Option C is incorrect because Age is a standalone, file-based key system and does not require an external KMS such as AWS KMS, GCP KMS, or Azure Key Vault. Option D is incorrect because SOPS with Age supports multiple recipients, so more than one person (or workload) can hold a private key and decrypt the files.

Answer

Age keys require an external KMS

Answer

Only one person can decrypt the files

Question 13

Which THREE of the following actions occur during an ArgoCD sync operation?

Accepted Answer

Comparing live state vs desired state. Option A is correct because an ArgoCD sync begins by comparing the live state of the cluster against the desired state stored in Git (the target revision), which determines what needs to change. Option D is correct because the sync operation then applies those differences to the cluster, using kubectl apply or server-side apply to reconcile resources to the desired manifests. Option E is correct because ArgoCD must fetch the latest manifests from the Git repository at the specified revision before it can render and apply them. Option B is not correct because ArgoCD performs a rolling or declarative update and does not delete all existing pods as part of a normal sync. Option C is not correct because ArgoCD deploys pre-built manifests and does not build or rebuild container images; image building is handled by CI pipelines.

Answer

Deleting all existing pods

Answer

Rebuilding the application image

Question 14

You are running Argo CD on a Kubernetes cluster. A developer reports that the argocd-application-controller repeatedly logs 'Failed to load target state: rpc error: code = Unknown desc = comparison error' for one Application, and the Application is stuck in the 'Unknown' health state. The cluster's outbound internet access is blocked, and the Application sources manifests from a private Git repository over HTTPS. Which component of Argo CD must you check first to resolve this?

Accepted Answer

The argocd-repo-server, because it is responsible for cloning the Git repository and generating the manifests, and it cannot reach the private repository.. The error indicates Argo CD cannot load the desired manifests from Git. The argocd-repo-server is the component that clones repositories and generates manifests, so blocked outbound access to the private Git repository will cause exactly this failure. Inspecting repo-server logs and connectivity is the correct troubleshooting step.

Answer

The argocd-application-controller, because it performs the actual Kubernetes API calls to apply resources and cannot connect to the API server.

Answer

The argocd-server, because it serves the web UI and API and must fetch the manifests on behalf of the controller.

Answer

The argocd-dex-server, because it provides authentication and the Application may be failing due to an expired token.

Question 15

You are using Flux with a GitRepository source that points to a private Git repository over HTTPS. Flux is failing to fetch the repository with an authentication error. You have created a Kubernetes Secret with the username and password. Which field in the GitRepository spec must reference this Secret?

Accepted Answer

spec.secretRef. In Flux, authentication for GitRepository sources is configured by referencing a Kubernetes Secret in the spec.secretRef field. This Secret must contain the appropriate credentials, such as username and password for HTTPS. The other options are not valid API fields, so they cannot be used to provide credentials.

Answer

spec.auth

Answer

spec.credentials

Answer

spec.sshCredentials