CGOA · domain
Gitops Patterns
This domain covers how GitOps repositories are structured and reconciled: ordering cluster-wide config before workloads, scoping secrets per region across clusters, App-of-Apps hierarchies, and progressive delivery rollback. Questions are scenario-based, asking you to pick the right Argo CD resource, sync wave, or promotion mechanism rather than recall definitions.
Focused practice
Practice Gitops Patterns questions
Scored sessions drawing only from this domain — pick a length below.
Start 20-question practice test →What this domain covers
What to know about Gitops Patterns
Be able to design a repo layout and Argo CD resources that order cluster-wide config before workloads, isolate regional secrets, nest child Applications under a parent, and automate canary rollback on error-rate spikes. The key is choosing the correct resource and sync ordering, not just writing manifests.
Using Argo CD sync waves and annotations to order cluster-wide config before application workloads
Scoping Secrets with Argo CD Projects, cluster generators, and ApplicationSets for regional segregation
Building App-of-Apps parents that reference child Argo CD Application manifests in Git
Driving canary rollback via Argo Rollouts analysis templates and automated promotion or abort
Why learners struggle
Why Gitops Patterns questions are commonly missed
NAT questions are missed when learners confuse the four address types (inside local, inside global, outside local, outside global) or misapply the interface direction. A translation rule can look correct but still fail if the ACL, interface, or direction is wrong.
- ·Inside local vs inside global — inside local is the private source, inside global is the translated public address
- ·PAT overloads — many sources share one public IP using unique port numbers
- ·Interface direction — ip nat inside and ip nat outside must be on the correct interfaces
- ·Static NAT vs dynamic NAT vs PAT — each serves a different use case
- ·The NAT ACL identifies traffic to translate, not traffic to permit or deny
- ·A missing translation can look like a routing problem if the interfaces are misconfigured
Watch out for
Common Gitops Patterns exam traps
- ▸Assuming all manifests in one Application sync in file order; without sync waves, ordering is not guaranteed.
- ▸Putting region-specific secrets in a shared Application instead of scoping them per cluster or project.
- ▸Treating the App-of-Apps parent as a workload app rather than a directory of child Application CRs.
Question index
All Gitops Patterns questions (57)
Click any question to see the full explanation, or start a practice session above.
What is the purpose of the 'destination' field in an Argo CD Application manifest?
Easy2You are deploying applications across multiple clusters using Argo CD. You want to implement a hub-and-spoke model where the central management cluster controls all edge clusters. Which THREE of the following are necessary to correctly configure this pattern?
Medium3In the context of GitOps, what is 'Configuration Drift'?
Easy4You notice your GitOps operator is performing too many API calls to the Kubernetes API server. What is the most likely configuration issue?
Medium5Which THREE of the following are necessary to prevent 'Secret Sprawl' in a multi-cluster environment? (Select three)
Hard6When using Argo CD, how do you handle applications that require resources to be created in a specific order (e.g., CRDs before Operators)?
Hard7You are troubleshooting a multi-cluster Argo CD deployment where the 'staging' cluster is healthy but 'production' cluster is 'OutOfSync' despite having the same manifest source. Why might this happen?
Medium8Your organization uses a 'Git-branch-per-environment' strategy. You notice that hotfixes applied to the 'production' branch are being overwritten by automatic merges from the 'staging' branch. Which GitOps promotion pattern should you adopt to prevent this drift?
Hard9During a blue-green deployment, what is the primary role of the traffic manager (e.g., Istio or Nginx Ingress)?
Medium10Which Argo CD feature allows you to manage multiple applications with shared configuration?
Medium11In a multi-cluster GitOps architecture using Argo CD, how do you manage credentials for a remote cluster that is not the cluster where Argo CD resides?
Medium12What is the main advantage of using a 'Declarative' approach to system management?
Easy13You are using a 'Pull' based GitOps model (e.g., Flux or Argo CD). Why is it considered more secure than a 'Push' based CI/CD model?
Hard14You are implementing progressive delivery with Flagger. You notice that the canary analysis is failing despite the new version being stable. What is the most common reason for this?
Medium15What does the 'prune' policy in GitOps do?
Easy16Which TWO of the following help ensure successful multi-cluster GitOps rollouts? (Select two)
Medium17Which THREE of the following represent advanced GitOps patterns for multi-cluster management? (Select three)
Hard18You are using Argo CD to manage a production application. A developer accidentally commits a change that sets the replica count to zero, and the change is merged to the main branch. You want to prevent this from happening again without blocking all changes to the repository. Which GitOps pattern should you implement?
Hard19When configuring an App-of-Apps pattern, which field in the 'Application' manifest controls the order in which child applications are deployed?
Hard20What happens if the 'revision' in an Argo CD Application points to a branch that does not exist?
Medium21You want to use Helm for your GitOps deployments. Where should the 'values.yaml' file reside for environment-specific overrides?
Medium22Which THREE of the following are benefits of using the App-of-Apps pattern? (Select THREE)
Easy23You are performing a Canary deployment using Argo Rollouts. You notice that the analysis template is failing even though the metrics are within range. What is the most common cause of this in a GitOps workflow?
Medium24In a GitOps promotion pipeline, why is it recommended to tag container images with a unique Git commit SHA instead of 'latest'?
Medium25When deploying across multiple clusters using Argo CD, you need to ensure that specific secrets are only available to clusters located in the 'us-east' region. Which resource should you use to enforce this segregation?
Easy26Which TWO of the following are features of progressive delivery in GitOps? (Select two)
Medium27Which TWO of the following are valid strategies for promoting an application from staging to production in GitOps? (Select two)
Medium28You are using Kustomize 'overlays' for environment promotion. If you need to add a specific label to all resources in production but not in staging, where should you define it?
Medium29What is the primary benefit of using a 'Git Branch' promotion pattern over a 'Directory-based' promotion pattern?
Easy30You are managing a large-scale deployment using the App-of-Apps pattern in Argo CD. Which resource type do you primarily use as the parent application to reference child application manifests?
Easy31You have a GitOps pipeline where you want to promote a change from Staging to Production. Using Argo CD, what is the recommended way to perform this promotion?
Easy32Which THREE of the following are essential security practices for GitOps? (Select three)
Hard33Which of the following is a core principle of GitOps?
Easy34What is the primary role of the 'Reconciler' in a GitOps operator?
Easy35You are managing a GitOps repository that contains both application manifests and cluster-wide configurations. You want to ensure that changes to cluster-wide configurations are applied before application workloads during a sync. Which Argo CD feature should you use?
Medium36Which THREE of the following are benefits of the 'App-of-Apps' pattern? (Select three)
Medium37You are implementing a GitOps promotion workflow where each environment (dev, staging, prod) has its own Kubernetes namespace in a single cluster. Your team wants to keep the base manifests identical and only vary replicas, resource limits, and image tags per environment. Which pattern should you use to achieve this with minimal duplication?
Medium38What is the primary function of an 'ApplicationSet' in Argo CD?
Medium39You are using Argo Rollouts for progressive delivery. You want to execute a 'AnalysisRun' before switching traffic. Where is the 'AnalysisTemplate' defined?
Hard40In a multi-cluster GitOps environment, you are using the ApplicationSet controller with a 'Cluster Generator'. You need to add a new cluster dynamically without modifying the ApplicationSet manifest. How should you achieve this?
Hard41When implementing multi-cluster GitOps, which THREE components are critical for success? (Select three)
Medium42Which THREE of the following are effective ways to handle 'Configuration Drift' in a GitOps environment? (Select three)
Medium43When promoting an application from staging to production using the 'GitOps directory' pattern, what is the most robust way to ensure environment-specific configurations are applied correctly?
Medium44Which TWO of the following are essential when using Helm in a GitOps workflow? (Select two)
Easy45Which TWO of the following are common benefits of using a 'GitOps Operator'? (Select two)
Medium46Which mechanism is used in a GitOps workflow to ensure that a 'Canary' deployment successfully rolls back if error rates spike?
Medium47What is the impact of enabling 'selfHeal' in an Argo CD Application sync policy?
Medium48Why would you choose to use 'Kustomize' over 'Helm' in a GitOps workflow?
Medium49In a blue-green progressive delivery deployment using Flagger, you notice that the 'primary' service is not receiving traffic even after the analysis successfully completes. What is the most likely cause?
Hard50Which TWO of the following are common reasons for a deployment to be marked as 'Degraded' by Argo CD? (Select two)
Medium51You are using Flux CD to manage a multi-tenant cluster. Each tenant has its own Git repository and namespace. You want to ensure that a tenant's Kustomization can only deploy resources into its own namespace and cannot modify cluster-scoped resources. Which Flux feature should you configure?
Hard52When setting up a multi-cluster GitOps pattern, what is the benefit of using 'Cluster Labels' in ApplicationSets?
Medium53When managing multiple environments (dev/stage/prod) in one repository, which folder structure is generally considered best practice?
Medium54If you have a multi-cluster setup and you want to ensure that 'production' clusters only pull images from a hardened internal registry, how can you enforce this in GitOps?
Hard55In GitOps, what is the 'Source of Truth'?
Easy56Which TWO of the following are true about the 'Pull' model in GitOps? (Select two)
Easy57You are designing a multi-cluster deployment with Argo CD. You want to avoid defining 50 individual Application manifests. Which feature should you use?
HardOther domains
All CGOA exam domains
Frequently asked questions
- What does the Gitops Patterns domain cover on the CGOA exam?
- Be able to design a repo layout and Argo CD resources that order cluster-wide config before workloads, isolate regional secrets, nest child Applications under a parent, and automate canary rollback on error-rate spikes. The key is choosing the correct resource and sync ordering, not just writing manifests.
- How many questions are in this domain?
- This page lists all 57 Gitops Patterns questions in the CGOA question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only Gitops Patterns questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.