Courseiva

CGOA · domain

Gitops Principles

This domain covers the four OpenGitOps principles — declarative desired state, versioned and immutable state, automated pull-based reconciliation, and continuous drift correction — and how they map to Kubernetes tooling like Flux and Argo CD. Questions test whether you can distinguish GitOps guarantees from ordinary CI/CD, choose correct secret handling, and enforce reconciliation over manual cluster edits.

101 questions21 easy48 medium32 hard

Focused practice

Practice Gitops Principles questions

Scored sessions drawing only from this domain — pick a length below.

Start 20-question practice test →

What this domain covers

What to know about Gitops Principles

Be able to explain each OpenGitOps principle and identify which Kubernetes mechanism implements it. The critical skill is recognizing that reconciliation is pull-based and continuous, so manual cluster changes are reverted and secrets never sit unencrypted in Git.

The four OpenGitOps principles and which conditions satisfy declarative and versioned immutable state

Flux and Argo CD pull-based reconciliation loops, controllers, and drift detection behavior

Secret management options such as Sealed Secrets, SOPS, and External Secrets Operator

Preventing manual kubectl edits through admission control, RBAC, and reconciliation enforcement

Watch out for

Common Gitops Principles exam traps

  • ▸Treating push-based CI pipelines as GitOps; the defining property is an in-cluster agent pulling and reconciling from Git
  • ▸Storing plaintext secrets in Git instead of encrypting them or referencing an external secret store
  • ▸Assuming Git commits alone change the cluster; without a running reconciler, drift persists and manual edits survive

Question index

All Gitops Principles questions (101)

Click any question to see the full explanation, or start a practice session above.

1

Which THREE of the following are core requirements for adopting a GitOps-based workflow?

Hard
2

Which TWO of the following are core principles of GitOps?

Medium
3

Which of the following is considered an 'Anti-pattern' in a GitOps workflow?

Easy
4

When configuring a GitOps tool, what is the purpose of a 'webhook' in relation to the Git repository?

Medium
5

Which of the following best describes the 'Declarative' principle in GitOps?

Easy
6

Which TWO are common strategies for GitOps repo structure?

Medium
7

When implementing a GitOps workflow with Argo CD, what is the role of the 'AppProject' custom resource?

Medium
8

Why must the desired state be 'versioned' in Git in a GitOps architecture?

Medium
9

When using Argo CD, what does the 'Sync Status' 'OutOfSync' indicate?

Medium
10

A team is transitioning to GitOps. Which action best aligns with the principle of Declarative Desired State?

Easy
11

Which statement best defines 'immutable state' in the context of GitOps?

Easy
12

In a multi-cluster environment, how does the GitOps principle of 'Declarative Desired State' simplify cluster management?

Hard
13

In a GitOps architecture, why is it critical that the entire state of the system is declarative?

Hard
14

A DevOps team is storing its Kubernetes manifests in a Git repository. To adhere strictly to the principle of versioned and immutable desired state in Git, how should the team manage changes to an existing deployment's container image tag?

Easy
15

When considering the GitOps principle of 'Declarative Desired State', which TWO of the following statements accurately reflect why manifests should be stored in Git?

Medium
16

In an Argo CD deployment, a developer notices that manual changes made via kubectl are being reverted automatically. What feature is responsible for this behavior?

Medium
17

In GitOps, what is a 'Merge Request' (or Pull Request) used for?

Easy
18

Which of these is NOT a principle of GitOps?

Easy
19

Why is 'pull-based' reconciliation considered more secure than 'push-based' CI/CD?

Hard
20

Which THREE components are typically involved in a GitOps reconciliation loop?

Medium
21

When syncing a Git repository to a cluster, what is the 'Sync Policy' in Argo CD?

Medium
22

A team is reviewing their deployment practices against OpenGitOps standards. Which THREE conditions are required to satisfy the 'Declarative Desired State' and 'Versioned and Immutable State' principles?

Easy
23

Your team is using a pull-based GitOps pattern. Which component is responsible for initiating the communication to the Git repository to check for updates?

Hard
24

Which TWO are common pitfalls in a GitOps implementation?

Medium
25

In the context of GitOps, what is meant by 'Pull-based' architecture?

Medium
26

Which THREE actions occur when a GitOps controller detects drift?

Hard
27

A platform team manages 50 Kubernetes clusters using GitOps. They need to ensure that an emergency rollback of an application across all clusters can be executed cleanly and audited effectively. What is the standard GitOps mechanism to achieve this rollback?

Medium
28

Which THREE of these are valid methods for handling configuration differences across environments (e.g., Dev vs Prod)?

Hard
29

A platform engineer wants to configure an application state declaratively. They write an imperative script containing commands like 'kubectl scale deployment --replicas=5' and push this script into a Git repository for execution by a cron job. Why does this approach fail to satisfy the core GitOps principle of 'Declarative Desired State'?

Hard
30

Your organization requires an audit trail of all changes to infrastructure. Why is GitOps superior to imperative 'kubectl' commands for this?

Hard
31

Which THREE activities are part of the 'Automated Pull-Based Reconciliation' process?

Hard
32

Which TWO scenarios represent 'drift' in a GitOps environment?

Hard
33

Which TWO of the following are primary benefits of storing the entire desired state of a system in a versioned Git repository?

Medium
34

What is the primary function of a 'GitOps Pipeline' versus a 'GitOps Controller'?

Medium
35

Which TWO items are typically included in a GitOps repository?

Medium
36

In a GitOps workflow, where does the 'source of truth' reside?

Medium
37

During an audit, an organization discovers that a secret was accidentally committed to a Git repository managed by Flux. An engineer deletes the commit containing the secret using 'git push --force' with a rewritten history. Why is this action problematic in a production GitOps environment?

Hard
38

Which TWO of the following are considered advantages of the GitOps approach?

Medium
39

Which THREE factors should be considered when choosing a GitOps controller?

Hard
40

Your team is using Flux CD to manage Kubernetes resources. You notice that the application status is 'Suspended'. What is the most likely reason for this state in the context of GitOps principles?

Medium
41

Why should you avoid using 'latest' as a container image tag in GitOps?

Medium
42

Which THREE items should be excluded from a GitOps repository?

Hard
43

Which TWO aspects of GitOps help ensure 'Continuous Drift Detection'?

Medium
44

What is the purpose of 'Image Tagging' in a GitOps workflow?

Medium
45

Which of these is a typical 'Desired State' artifact in GitOps?

Easy
46

What is the primary risk of a 'Push-based' deployment model compared to 'Pull-based'?

Hard
47

What is the primary function of the 'reconciliation loop' in GitOps?

Easy
48

If a GitOps controller detects that an image tag has been changed in the cluster but not in Git, what does the controller do?

Hard
49

How does GitOps help with disaster recovery?

Medium
50

Which THREE of the following are essential components of an effective GitOps 'Continuous Drift Detection and Correction' strategy?

Hard
51

Which of these is a valid 'GitOps' approach for multi-environment management?

Easy
52

A company is adopting GitOps and wants to ensure their implementation follows the core principles. They are reviewing their current practices and need to identify which of the following are considered core GitOps principles. (Choose two.)

Medium
53

A DevOps team is adopting GitOps for their Kubernetes environment. They want to ensure that all changes to the cluster are made through Git, and that the cluster state is always in sync with the Git repository. They also want to avoid manual kubectl commands. Which GitOps principle is most directly violated if a team member uses 'kubectl apply' to update a Deployment?

Medium
54

An organization uses Argo CD to manage Kubernetes clusters. A developer manually modifies a Deployment's replica count via kubectl. Which mechanism in Argo CD ensures this manual change is identified as non-compliant with the GitOps repository?

Medium
55

A company uses Flux to manage a Kubernetes cluster. During a recent security audit, they found that an engineer manually edited a ConfigMap directly in the live cluster using 'kubectl edit', causing the cluster state to drift from the Git repository. The engineer wants to ensure that such manual changes are automatically reverted to match Git. Which GitOps principle should they enforce?

Hard
56

You are using Argo CD. A developer manually scales a Deployment replica count using 'kubectl scale'. What happens next in a standard GitOps implementation?

Medium
57

A developer pushes a change to Git, but the cluster does not update. Which log source is most effective for debugging the pull-based mechanism?

Medium
58

What is the primary role of an 'Immutable' state in a GitOps repository?

Easy
59

Why does GitOps encourage the use of small, frequent commits?

Medium
60

An organization is migrating to GitOps using Argo CD. During an audit, you notice that manual changes made directly to the Kubernetes cluster via kubectl are being reverted within minutes. Which component of the GitOps pipeline is performing this action?

Medium
61

When should you use Kustomize in a GitOps workflow?

Medium
62

Which of the following is a primary benefit of using a GitOps pull-based model over a push-based CI/CD model?

Easy
63

You are implementing a GitOps workflow where the desired state is stored in a private repository. The Argo CD controller requires access to this repository. What is the most secure GitOps-compliant way to provide this access?

Medium
64

What is the primary role of the 'Git' repository in the GitOps cycle?

Easy
65

Which THREE features of Kubernetes are commonly used to support GitOps?

Hard
66

Which of these is the most suitable tool to use as the 'Git' component of GitOps?

Easy
67

You are configuring an automated GitOps pipeline. How do you prevent 'drift' from occurring due to out-of-band changes?

Hard
68

An application is failing because a developer accidentally edited a ConfigMap in the cluster directly. Which GitOps feature prevents this from recurring?

Medium
69

You need to ensure that no one can modify cluster resources manually. How can you implement this in a GitOps-mature organization?

Hard
70

You are implementing GitOps for a legacy application. Why might this be challenging?

Hard
71

Which TWO practices are recommended when managing Git repositories for GitOps?

Medium
72

A team is implementing GitOps for their infrastructure. They want to ensure that the entire system state is described in a way that can be versioned, reviewed, and automatically applied. Which characteristic of GitOps best describes the practice of storing all configuration as code in Git?

Easy
73

An organization is implementing GitOps across its infrastructure using Kubernetes and Flux. Which TWO statements accurately describe core characteristics of the 'Automated Pull-Based Reconciliation' principle?

Medium
74

Which TWO tools are commonly associated with the 'GitOps' ecosystem?

Medium
75

In a large enterprise, why is GitOps preferred for multi-cluster environments?

Medium
76

A developer updates a Helm release values file in Git to change a ConfigMap key. How does the GitOps pull-based agent determine that reconciliation is necessary?

Easy
77

Which THREE of the following are common GitOps tools used in the CNCF ecosystem?

Easy
78

What is the recommended way to handle secrets in GitOps?

Medium
79

In GitOps, what does 'Self-Healing' mean?

Hard
80

Which THREE mechanisms can be used to notify a GitOps controller of a change in Git?

Hard
81

You are debugging a GitOps deployment. The controller shows 'OutOfSync' but the cluster seems to be running correctly. What is the most likely cause?

Hard
82

Which THREE are standard ways to implement GitOps with Helm?

Hard
83

An administrator notices that an engineer manually modified a Service loadBalancerIP in the Kubernetes live cluster using 'kubectl edit'. The cluster is managed by an automated GitOps engine configured in a pull-based model. What will happen during the next reconciliation cycle?

Medium
84

Which of the following is NOT a benefit of the GitOps model?

Easy
85

What is a 'GitOps Operator'?

Hard
86

What is the relationship between the 'desired state' and the 'actual state' in GitOps?

Easy
87

Which TWO of the following are primary benefits of storing immutable state in Git?

Medium
88

Which TWO are examples of 'Drift' in a GitOps environment?

Medium
89

A senior cloud architect is designing a multi-tenant platform using GitOps. They want to ensure that continuous drift detection and correction operate reliably without causing system instability. Which TWO practices help mitigate risks associated with automated continuous drift correction?

Hard
90

You are implementing a GitOps pipeline for a complex microservices architecture. To satisfy the principle of 'versioned and immutable state', how should you handle environment-specific configurations while maintaining a single source of truth?

Hard
91

In a GitOps environment, an engineer manually deletes a Deployment via 'kubectl'. What should happen next to maintain the desired state?

Medium
92

You are troubleshooting a Flux controller that is not reconciling changes. The Git repository is updated, but the cluster remains unchanged. Which component should you inspect first to verify the 'automated pull-based reconciliation'?

Hard
93

Which of the following actions best aligns with the GitOps principle of 'Automated Pull-Based Reconciliation'?

Easy
94

What is the primary advantage of storing Kubernetes manifests in a version-controlled repository?

Medium
95

A company is choosing between a push-based CI/CD pipeline (e.g., executing 'kubectl apply' from GitHub Actions) and a pull-based GitOps controller (e.g., Argo CD or Flux). Which security advantage is uniquely provided by adopting the pull-based architecture?

Medium
96

When utilizing Git as the 'Source of Truth' for a cluster, what happens if the cluster state diverges from Git?

Medium
97

Which THREE components are essential for a robust pull-based GitOps deployment?

Hard
98

When defining a declarative desired state in Kubernetes, which attribute is essential to satisfy the 'declarative' principle?

Medium
99

Which TWO benefits does GitOps provide for team collaboration?

Medium
100

Which THREE principles are foundational to the GitOps model as defined by the CNCF GitOps Working Group?

Hard
101

Which TWO characteristics help ensure a GitOps repository is auditable?

Medium

Frequently asked questions

What does the Gitops Principles domain cover on the CGOA exam?
Be able to explain each OpenGitOps principle and identify which Kubernetes mechanism implements it. The critical skill is recognizing that reconciliation is pull-based and continuous, so manual cluster changes are reverted and secrets never sit unencrypted in Git.
How many questions are in this domain?
This page lists all 101 Gitops Principles questions in the CGOA question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
What is the best way to practise this domain?
Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
Can I practise only Gitops Principles questions?
Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.
Certified GitOps Associate (CGOA, CNCF/Linux Foundation) (CGOA) Gitops Principles Practice Questions