CGOA Related Practices Practice Question
A security auditor asks how your team handles secret management in a GitOps environment without exposing sensitive credentials in the Git repository. What is the standard GitOps practice for this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a tool like Bitnami Sealed Secrets to encrypt secrets that can be decrypted only by the cluster controller.
GitOps relies on tools like Sealed Secrets or external secret stores to inject credentials at runtime, keeping secrets out of the Git repository.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a tool like Bitnami Sealed Secrets to encrypt secrets that can be decrypted only by the cluster controller.
Why this is correct
Sealed Secrets allow secrets to be safely stored in Git while ensuring only the target cluster can decrypt them.
- ✗
Create a separate private repository for secrets and clone it during the CI/CD pipeline execution.
Why it's wrong here
This increases complexity and creates a separate source of truth, violating the GitOps requirement for a single unified repository.
- ✗
Use Git LFS to encrypt the secret files before pushing them to the remote repository.
Why it's wrong here
Git LFS is for large files and does not provide the robust secret management lifecycle integration required for GitOps.
- ✗
Store secrets in the repository as Base64 encoded environment variables.
Why it's wrong here
Base64 is an encoding, not encryption, and still exposes secrets in plaintext in the repository.
About these practice questions
Courseiva writes every CGOA question from scratch — 325 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This CGOA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGOA exam.