CGOA · domain
Gitops Principles
This domain covers the four OpenGitOps principles — declarative desired state, versioned and immutable state, automated pull-based reconciliation, and continuous drift correction — and how they map to Kubernetes tooling like Flux and Argo CD. Questions test whether you can distinguish GitOps guarantees from ordinary CI/CD, choose correct secret handling, and enforce reconciliation over manual cluster edits.
Focused practice
Practice Gitops Principles questions
Scored sessions drawing only from this domain — pick a length below.
Start 20-question practice test →What this domain covers
What to know about Gitops Principles
Be able to explain each OpenGitOps principle and identify which Kubernetes mechanism implements it. The critical skill is recognizing that reconciliation is pull-based and continuous, so manual cluster changes are reverted and secrets never sit unencrypted in Git.
The four OpenGitOps principles and which conditions satisfy declarative and versioned immutable state
Flux and Argo CD pull-based reconciliation loops, controllers, and drift detection behavior
Secret management options such as Sealed Secrets, SOPS, and External Secrets Operator
Preventing manual kubectl edits through admission control, RBAC, and reconciliation enforcement
Watch out for
Common Gitops Principles exam traps
- ▸Treating push-based CI pipelines as GitOps; the defining property is an in-cluster agent pulling and reconciling from Git
- ▸Storing plaintext secrets in Git instead of encrypting them or referencing an external secret store
- ▸Assuming Git commits alone change the cluster; without a running reconciler, drift persists and manual edits survive
Question index
All Gitops Principles questions (101)
Click any question to see the full explanation, or start a practice session above.
Which THREE of the following are core requirements for adopting a GitOps-based workflow?
Hard2Which TWO of the following are core principles of GitOps?
Medium3Which of the following is considered an 'Anti-pattern' in a GitOps workflow?
Easy4When configuring a GitOps tool, what is the purpose of a 'webhook' in relation to the Git repository?
Medium5Which of the following best describes the 'Declarative' principle in GitOps?
Easy6Which TWO are common strategies for GitOps repo structure?
Medium7When implementing a GitOps workflow with Argo CD, what is the role of the 'AppProject' custom resource?
Medium8Why must the desired state be 'versioned' in Git in a GitOps architecture?
Medium9When using Argo CD, what does the 'Sync Status' 'OutOfSync' indicate?
Medium10A team is transitioning to GitOps. Which action best aligns with the principle of Declarative Desired State?
Easy11Which statement best defines 'immutable state' in the context of GitOps?
Easy12In a multi-cluster environment, how does the GitOps principle of 'Declarative Desired State' simplify cluster management?
Hard13In a GitOps architecture, why is it critical that the entire state of the system is declarative?
Hard14A DevOps team is storing its Kubernetes manifests in a Git repository. To adhere strictly to the principle of versioned and immutable desired state in Git, how should the team manage changes to an existing deployment's container image tag?
Easy15When considering the GitOps principle of 'Declarative Desired State', which TWO of the following statements accurately reflect why manifests should be stored in Git?
Medium16In an Argo CD deployment, a developer notices that manual changes made via kubectl are being reverted automatically. What feature is responsible for this behavior?
Medium17In GitOps, what is a 'Merge Request' (or Pull Request) used for?
Easy18Which of these is NOT a principle of GitOps?
Easy19Why is 'pull-based' reconciliation considered more secure than 'push-based' CI/CD?
Hard20Which THREE components are typically involved in a GitOps reconciliation loop?
Medium21When syncing a Git repository to a cluster, what is the 'Sync Policy' in Argo CD?
Medium22A team is reviewing their deployment practices against OpenGitOps standards. Which THREE conditions are required to satisfy the 'Declarative Desired State' and 'Versioned and Immutable State' principles?
Easy23Your team is using a pull-based GitOps pattern. Which component is responsible for initiating the communication to the Git repository to check for updates?
Hard24Which TWO are common pitfalls in a GitOps implementation?
Medium25In the context of GitOps, what is meant by 'Pull-based' architecture?
Medium26Which THREE actions occur when a GitOps controller detects drift?
Hard27A platform team manages 50 Kubernetes clusters using GitOps. They need to ensure that an emergency rollback of an application across all clusters can be executed cleanly and audited effectively. What is the standard GitOps mechanism to achieve this rollback?
Medium28Which THREE of these are valid methods for handling configuration differences across environments (e.g., Dev vs Prod)?
Hard29A platform engineer wants to configure an application state declaratively. They write an imperative script containing commands like 'kubectl scale deployment --replicas=5' and push this script into a Git repository for execution by a cron job. Why does this approach fail to satisfy the core GitOps principle of 'Declarative Desired State'?
Hard30Your organization requires an audit trail of all changes to infrastructure. Why is GitOps superior to imperative 'kubectl' commands for this?
Hard31Which THREE activities are part of the 'Automated Pull-Based Reconciliation' process?
Hard32Which TWO scenarios represent 'drift' in a GitOps environment?
Hard33Which TWO of the following are primary benefits of storing the entire desired state of a system in a versioned Git repository?
Medium34What is the primary function of a 'GitOps Pipeline' versus a 'GitOps Controller'?
Medium35Which TWO items are typically included in a GitOps repository?
Medium36In a GitOps workflow, where does the 'source of truth' reside?
Medium37During an audit, an organization discovers that a secret was accidentally committed to a Git repository managed by Flux. An engineer deletes the commit containing the secret using 'git push --force' with a rewritten history. Why is this action problematic in a production GitOps environment?
Hard38Which TWO of the following are considered advantages of the GitOps approach?
Medium39Which THREE factors should be considered when choosing a GitOps controller?
Hard40Your team is using Flux CD to manage Kubernetes resources. You notice that the application status is 'Suspended'. What is the most likely reason for this state in the context of GitOps principles?
Medium41Why should you avoid using 'latest' as a container image tag in GitOps?
Medium42Which THREE items should be excluded from a GitOps repository?
Hard43Which TWO aspects of GitOps help ensure 'Continuous Drift Detection'?
Medium44What is the purpose of 'Image Tagging' in a GitOps workflow?
Medium45Which of these is a typical 'Desired State' artifact in GitOps?
Easy46What is the primary risk of a 'Push-based' deployment model compared to 'Pull-based'?
Hard47What is the primary function of the 'reconciliation loop' in GitOps?
Easy48If a GitOps controller detects that an image tag has been changed in the cluster but not in Git, what does the controller do?
Hard49How does GitOps help with disaster recovery?
Medium50Which THREE of the following are essential components of an effective GitOps 'Continuous Drift Detection and Correction' strategy?
Hard51Which of these is a valid 'GitOps' approach for multi-environment management?
Easy52A company is adopting GitOps and wants to ensure their implementation follows the core principles. They are reviewing their current practices and need to identify which of the following are considered core GitOps principles. (Choose two.)
Medium53A DevOps team is adopting GitOps for their Kubernetes environment. They want to ensure that all changes to the cluster are made through Git, and that the cluster state is always in sync with the Git repository. They also want to avoid manual kubectl commands. Which GitOps principle is most directly violated if a team member uses 'kubectl apply' to update a Deployment?
Medium54An organization uses Argo CD to manage Kubernetes clusters. A developer manually modifies a Deployment's replica count via kubectl. Which mechanism in Argo CD ensures this manual change is identified as non-compliant with the GitOps repository?
Medium55A company uses Flux to manage a Kubernetes cluster. During a recent security audit, they found that an engineer manually edited a ConfigMap directly in the live cluster using 'kubectl edit', causing the cluster state to drift from the Git repository. The engineer wants to ensure that such manual changes are automatically reverted to match Git. Which GitOps principle should they enforce?
Hard56You are using Argo CD. A developer manually scales a Deployment replica count using 'kubectl scale'. What happens next in a standard GitOps implementation?
Medium57A developer pushes a change to Git, but the cluster does not update. Which log source is most effective for debugging the pull-based mechanism?
Medium58What is the primary role of an 'Immutable' state in a GitOps repository?
Easy59Why does GitOps encourage the use of small, frequent commits?
Medium60An organization is migrating to GitOps using Argo CD. During an audit, you notice that manual changes made directly to the Kubernetes cluster via kubectl are being reverted within minutes. Which component of the GitOps pipeline is performing this action?
Medium61When should you use Kustomize in a GitOps workflow?
Medium62Which of the following is a primary benefit of using a GitOps pull-based model over a push-based CI/CD model?
Easy63You are implementing a GitOps workflow where the desired state is stored in a private repository. The Argo CD controller requires access to this repository. What is the most secure GitOps-compliant way to provide this access?
Medium64What is the primary role of the 'Git' repository in the GitOps cycle?
Easy65Which THREE features of Kubernetes are commonly used to support GitOps?
Hard66Which of these is the most suitable tool to use as the 'Git' component of GitOps?
Easy67You are configuring an automated GitOps pipeline. How do you prevent 'drift' from occurring due to out-of-band changes?
Hard68An application is failing because a developer accidentally edited a ConfigMap in the cluster directly. Which GitOps feature prevents this from recurring?
Medium69You need to ensure that no one can modify cluster resources manually. How can you implement this in a GitOps-mature organization?
Hard70You are implementing GitOps for a legacy application. Why might this be challenging?
Hard71Which TWO practices are recommended when managing Git repositories for GitOps?
Medium72A team is implementing GitOps for their infrastructure. They want to ensure that the entire system state is described in a way that can be versioned, reviewed, and automatically applied. Which characteristic of GitOps best describes the practice of storing all configuration as code in Git?
Easy73An organization is implementing GitOps across its infrastructure using Kubernetes and Flux. Which TWO statements accurately describe core characteristics of the 'Automated Pull-Based Reconciliation' principle?
Medium74Which TWO tools are commonly associated with the 'GitOps' ecosystem?
Medium75In a large enterprise, why is GitOps preferred for multi-cluster environments?
Medium76A developer updates a Helm release values file in Git to change a ConfigMap key. How does the GitOps pull-based agent determine that reconciliation is necessary?
Easy77Which THREE of the following are common GitOps tools used in the CNCF ecosystem?
Easy78What is the recommended way to handle secrets in GitOps?
Medium79In GitOps, what does 'Self-Healing' mean?
Hard80Which THREE mechanisms can be used to notify a GitOps controller of a change in Git?
Hard81You are debugging a GitOps deployment. The controller shows 'OutOfSync' but the cluster seems to be running correctly. What is the most likely cause?
Hard82Which THREE are standard ways to implement GitOps with Helm?
Hard83An administrator notices that an engineer manually modified a Service loadBalancerIP in the Kubernetes live cluster using 'kubectl edit'. The cluster is managed by an automated GitOps engine configured in a pull-based model. What will happen during the next reconciliation cycle?
Medium84Which of the following is NOT a benefit of the GitOps model?
Easy85What is a 'GitOps Operator'?
Hard86What is the relationship between the 'desired state' and the 'actual state' in GitOps?
Easy87Which TWO of the following are primary benefits of storing immutable state in Git?
Medium88Which TWO are examples of 'Drift' in a GitOps environment?
Medium89A senior cloud architect is designing a multi-tenant platform using GitOps. They want to ensure that continuous drift detection and correction operate reliably without causing system instability. Which TWO practices help mitigate risks associated with automated continuous drift correction?
Hard90You are implementing a GitOps pipeline for a complex microservices architecture. To satisfy the principle of 'versioned and immutable state', how should you handle environment-specific configurations while maintaining a single source of truth?
Hard91In a GitOps environment, an engineer manually deletes a Deployment via 'kubectl'. What should happen next to maintain the desired state?
Medium92You are troubleshooting a Flux controller that is not reconciling changes. The Git repository is updated, but the cluster remains unchanged. Which component should you inspect first to verify the 'automated pull-based reconciliation'?
Hard93Which of the following actions best aligns with the GitOps principle of 'Automated Pull-Based Reconciliation'?
Easy94What is the primary advantage of storing Kubernetes manifests in a version-controlled repository?
Medium95A company is choosing between a push-based CI/CD pipeline (e.g., executing 'kubectl apply' from GitHub Actions) and a pull-based GitOps controller (e.g., Argo CD or Flux). Which security advantage is uniquely provided by adopting the pull-based architecture?
Medium96When utilizing Git as the 'Source of Truth' for a cluster, what happens if the cluster state diverges from Git?
Medium97Which THREE components are essential for a robust pull-based GitOps deployment?
Hard98When defining a declarative desired state in Kubernetes, which attribute is essential to satisfy the 'declarative' principle?
Medium99Which TWO benefits does GitOps provide for team collaboration?
Medium100Which THREE principles are foundational to the GitOps model as defined by the CNCF GitOps Working Group?
Hard101Which TWO characteristics help ensure a GitOps repository is auditable?
MediumOther domains
All CGOA exam domains
Frequently asked questions
- What does the Gitops Principles domain cover on the CGOA exam?
- Be able to explain each OpenGitOps principle and identify which Kubernetes mechanism implements it. The critical skill is recognizing that reconciliation is pull-based and continuous, so manual cluster changes are reverted and secrets never sit unencrypted in Git.
- How many questions are in this domain?
- This page lists all 101 Gitops Principles questions in the CGOA question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only Gitops Principles questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.