CCNA Related Practices Questions

MCQhard

When implementing DevSecOps within a GitOps workflow, where should the automated policy enforcement (like OPA/Gatekeeper) occur?

A.During the Git commit process using local pre-commit hooks.

B.In the CI pipeline during the image scanning phase.

C.At the Kubernetes API server using an Admission Controller like OPA Gatekeeper.

D.By manually reviewing the Git diffs before merging the pull request.

AnswerC

Admission controllers evaluate resources at the point of creation, providing a final security gate regardless of how the manifest was deployed.

Why this answer

Policy enforcement should happen during the admission control phase of the Kubernetes API to ensure all resources, including those managed by GitOps, comply.

Practice this question →

MCQeasy

Why is 'Git' considered the 'source of truth' in GitOps?

A.Because it acts as the single point of record for the desired system state.

B.Because Git stores all application logs.

C.Because it is the only tool that supports branching.

D.Because Git automatically runs the applications.

AnswerA

Git holds the manifests that define what the system should look like.

Why this answer

Git provides a clear, immutable, and auditable history of every change made to the system, which is essential for reproducibility.

Practice this question →

MCQeasy

What is the primary function of an 'Admission Controller' in a GitOps-based DevSecOps workflow?

A.To build container images.

B.To validate and enforce policies on cluster resources before they are persisted.

C.To monitor application logs for errors.

D.To trigger the CI/CD pipeline.

AnswerB

This prevents non-compliant resources from ever being created.

Why this answer

Admission controllers act as a final gate, validating or mutating requests to the Kubernetes API to ensure they comply with organizational policies.

Practice this question →

Multi-Selectmedium

Which THREE of the following are primary benefits of adopting GitOps for CI/CD integration?

Select 3 answers

A.Faster code compilation times compared to traditional CI systems.

B.Increased consistency between environments through standardized Git workflows.

C.Reduced need for automated security scanning.

D.Simplified disaster recovery by re-applying the Git state to a new cluster.

E.Improved auditability of changes through Git commit history.

AnswersB, D, E

Using the same deployment process across all environments reduces configuration drift.

Why this answer

GitOps improves auditability, disaster recovery, and operational consistency by centralizing the source of truth in Git.

Practice this question →

Multi-Selecthard

Which TWO of the following are common challenges when implementing GitOps in an organization?

Select 2 answers

A.Addressing configuration drift caused by manual changes to the cluster.

B.Managing secrets in a secure way within the version control system.

C.The requirement to use only open-source software.

D.The speed at which Git servers process pull requests.

E.The lack of support for containerization in the organization.

AnswersA, B

Legacy environments often have undocumented manual changes that must be reconciled.

Why this answer

Managing secrets and dealing with existing drift in legacy environments are significant hurdles in adopting GitOps.

Practice this question →

MCQhard

When using a GitOps operator that performs 'image polling', what is the risk of using a 'latest' tag?

A.It causes high latency in the cluster.

B.The GitOps operator cannot detect changes.

C.It consumes too much disk space.

D.It makes rollbacks impossible because the 'latest' image may be different than what was deployed.

AnswerD

Without unique tags, you cannot guarantee which version is actually running.

Why this answer

The 'latest' tag is mutable, meaning it can point to different code at different times, violating the GitOps principle of deterministic, reproducible deployments.

Practice this question →

MCQhard

You are debugging a drift in a GitOps environment. The cluster state differs from the Git repository. What is the most likely cause if you are using Flux?

A.The container registry is unreachable during a new image rollout.

B.The Git repository contains syntax errors in the YAML files.

C.A user performed a manual 'kubectl' command to modify a deployment.

D.The CI pipeline failed to run tests.

AnswerC

Manual changes bypass Git, causing the cluster state to deviate from the desired state defined in Git.

Why this answer

Flux reconcilers periodically verify the cluster state; drift usually occurs when an external actor modifies the cluster directly or a manual change occurred.

Practice this question →

MCQmedium

Your organization is transitioning from imperative scripts to Infrastructure as Code (IaC) using Terraform. You need to ensure that the infrastructure state remains synchronized with the Git repository after every commit. Which approach best aligns with GitOps principles?

A.Configure a CI pipeline to run terraform apply only when a manual approval is provided by the operations team.

B.Deploy a GitOps controller like Flux or Argo CD to monitor the Terraform state files in Git and apply changes automatically.

C.Execute a scheduled cron job that runs terraform apply.

D.Use a webhook to trigger a shell script that pulls the latest changes from the main branch.

AnswerB

GitOps controllers provide the continuous reconciliation loop required to keep infrastructure state in sync with Git.

Why this answer

GitOps requires a declarative source of truth where the current state of infrastructure is automatically reconciled against the desired state defined in Git.

Practice this question →

Multi-Selectmedium

Which THREE components are essential for a complete GitOps CI/CD pipeline?

Select 3 answers

A.An automated controller that reconciles the cluster to the Git state.

B.A CI system that updates the manifest repository.

C.A human-operated dashboard for manual deployment.

D.A version control system (Git) acting as the source of truth.

E.A dedicated server for storing logs.

AnswersA, B, D

This is the engine of the GitOps process.

Why this answer

A complete GitOps pipeline requires a Git repository for state, a CI process for artifact creation, and a CD operator for reconciliation.

Practice this question →

Multi-Selecteasy

Which TWO of the following are core principles of the GitOps model?

Select 2 answers

A.All code is written in Go.

B.Changes are automatically reconciled to match the declared state.

C.Manual updates are preferred for emergency fixes.

D.The desired state is defined in a version-controlled repository.

E.Developers have direct SSH access to the production cluster.

AnswersB, D

This is the core duty of the GitOps operator.

Why this answer

GitOps is based on the system state being explicitly declared in a version control system and then continuously reconciled by an automated operator.

Practice this question →

MCQeasy

Which of these is a primary benefit of 'Infrastructure as Code' (IaC) in a GitOps workflow?

A.It replaces the need for monitoring.

B.It enables the entire infrastructure to be versioned and reconciled automatically.

C.It reduces the number of developers needed.

D.It makes the cloud provider cheaper.

AnswerB

This is the core benefit of applying GitOps principles to infrastructure.

Why this answer

IaC allows infrastructure to be treated with the same rigor as application code, enabling versioning, testing, and automated reconciliation.

Practice this question →

MCQeasy

Which action should a developer take to deploy a new version of an application in a GitOps-based workflow?

A.Wait for the automated CI/CD tool to trigger a redeployment.

B.Submit a pull request to the Git repository containing the configuration update.

C.Run 'kubectl apply' from their local machine.

D.Log into the Argo CD dashboard and click 'Deploy'.

AnswerB

This is the standard GitOps workflow for requesting and applying changes.

Why this answer

The developer updates the manifest (e.g., image tag) in the Git repository and merges it, triggering the GitOps operator to update the cluster.

Practice this question →

MCQhard

A company uses Terraform for IaC and Argo CD for application delivery. How should they manage the dependency between infrastructure provisioning and app deployment to ensure GitOps consistency?

A.Use Crossplane to represent infrastructure as Kubernetes objects, managing both IaC and apps via GitOps.

B.Execute Terraform via a CI job that triggers Argo CD after completion.

C.Manually trigger Terraform runs before pushing new app manifests to Git.

D.Embed Terraform binary execution within a K8s deployment container.

AnswerA

Crossplane extends the GitOps pattern to infrastructure, ensuring the state is reconciled by an operator.

Why this answer

Using a tool like Crossplane or an orchestrator ensures that infrastructure and applications are synchronized through the same Git-based reconciliation loop.

Practice this question →

MCQmedium

When implementing a CI/CD pipeline for GitOps, how should you handle image tag updates?

A.Having the CD operator pull the 'latest' tag directly from the registry.

B.Manually updating the YAML file with the new image tag and committing to Git.

C.Triggering a shell script to update the cluster state directly from the CI pipeline.

D.Using an automated agent that detects new images and commits the tag change back to the Git repo.

AnswerD

Automated updates ensure the desired state in Git remains current without manual intervention.

Why this answer

Automating image updates through a tool like Renovate or Argo CD Image Updater ensures the repository is kept in sync with the latest build artifacts.

Practice this question →

Multi-Selecteasy

Which TWO of the following are core components of a mature GitOps-based DevSecOps practice?

Select 2 answers

A.Using manual SSH access for emergency production troubleshooting.

B.Ensuring all developers have cluster-admin privileges for rapid debugging.

C.Relying primarily on graphical user interfaces for cluster management.

D.Integrating automated security policies (like OPA) into the deployment workflow.

E.Defining infrastructure as code to ensure repeatability.

AnswersD, E

Policy enforcement ensures that all deployments meet security standards.

Why this answer

IaC and automated policy gates are essential to manage infrastructure safely and securely.

Practice this question →

MCQeasy

What is the primary benefit of using a pull-based GitOps operator compared to a push-based CI/CD system?

A.It eliminates the need for container registries.

B.You can use fewer Git branches.

C.The CI system runs faster.

D.The cluster does not need inbound access from the CI pipeline.

AnswerD

The operator pulls from within the cluster, removing the need for exposed API server credentials in the CI tool.

Why this answer

Pull-based systems don't require the CI system to have credentials for the cluster, improving security and enabling autonomous reconciliation.

Practice this question →

MCQeasy

Which of the following describes the 'Declarative' aspect of GitOps?

A.Manually clicking buttons in a UI to scale a service.

B.Defining the desired state in a YAML file.

C.Creating a list of commands to run in order.

D.Writing a shell script to upgrade a deployment.

AnswerB

This is the essence of declarative configuration.

Why this answer

Declarative means describing the 'what' (the final state) rather than the 'how' (the steps to achieve it).

Practice this question →

MCQmedium

Why do you use a separate repository for application code and application manifests (deployment manifests) in GitOps?

A.It is required by the Kubernetes specification.

B.Because they are written in different languages.

C.To allow different teams to manage code and configuration independently and securely.

D.It makes the CI/CD pipeline run faster.

AnswerC

This separation allows for a clear boundary between development and operations/delivery.

Why this answer

Separating the source code from the environment configuration allows for independent lifecycle management and improved security scoping.

Practice this question →

MCQmedium

When migrating to GitOps, why is 'Pull' preferred over 'Push' for CD?

A.It makes the deployment process faster.

B.It removes the need for exposed API server credentials in the CI tool.

C.It eliminates the need for Git.

D.It allows developers to push code directly to production.

AnswerB

By pulling from within the cluster, the cluster remains secure behind firewalls.

Why this answer

Pull-based systems are more secure as they don't require external entities to have write access to the cluster's internal credentials.

Practice this question →

MCQeasy

What is the key difference between Configuration as Code and Infrastructure as Code in the context of GitOps?

A.Configuration as Code is only for databases.

B.Config as Code is always written in YAML.

C.They are the same thing.

D.IaC defines the underlying resources, while Config as Code defines the application-level settings.

AnswerD

This is the standard distinction between infrastructure and configuration.

Why this answer

Infrastructure as Code focuses on the underlying environment (VMs, networks), while Configuration as Code focuses on the software services and their settings.

Practice this question →

MCQhard

What is the most effective approach to handle 'secrets' in GitOps when you require strict compliance that mandates secrets never exist in plain text in the repo?

A.Use an external secret store that injects values into the cluster at runtime.

B.Store secrets in an encrypted cloud storage bucket and manually map them.

C.Use standard Kubernetes secrets and hope for the best.

D.Use Sealed Secrets with a public key in Git.

AnswerA

This keeps secrets completely out of Git, meeting the strictest security requirements.

Why this answer

External Secrets Operator or HashiCorp Vault integration fetches secrets from a secure, external source and injects them into the cluster, so they are never in the Git repo.

Practice this question →

MCQhard

You are migrating a legacy application deployment process to GitOps. The application requires a specific sequence of database migrations to run before the new container version is deployed. How do you implement this in a GitOps-friendly way?

A.Use a Kubernetes 'Job' resource that runs before the Deployment, and manage dependencies with initContainers or Helm hooks.

B.Add a 'kubectl apply' command to the end of the CI pipeline to execute migrations.

C.Hardcode the migration logic into the application source code to run on startup.

D.Create a manual trigger in the GitOps dashboard to execute the migration after the deployment starts.

E.Configure the GitOps agent to execute a shell script on the node before pulling the image.

AnswerA

Helm hooks or Kubernetes Jobs allow declarative definition of prerequisites that the GitOps controller can manage.

Why this answer

GitOps relies on reconciliation. Pre-deployment tasks should be managed via Kubernetes Jobs or hooks that maintain the declarative nature of the cluster state.

Practice this question →

MCQhard

In a GitOps pattern, how do you manage a rollback when an application deployment fails?

A.Revert the commit in Git and let the GitOps operator reconcile.

B.Delete the pods and let the operator recreate them.

C.Stop the GitOps operator to prevent it from correcting the state.

D.Run 'kubectl rollout undo' on the deployment.

AnswerA

Reverting the state in Git ensures the desired state is returned to a known good version.

Why this answer

Rolling back involves reverting the commit in Git, which the operator then detects and reconciles to return the cluster to the previous working state.

Practice this question →

MCQmedium

You are auditing a GitOps process. Which of the following is an indicator that the process is NOT truly following GitOps principles?

A.Secrets are encrypted in the Git repo.

B.The cluster automatically reconciles changes pushed to Git.

C.Developers use PRs to propose changes to the environment.

D.An administrator manually updates a Kubernetes Deployment manifest directly on the cluster.

AnswerD

Manual cluster modifications lead to drift and undermine the Git source of truth.

Why this answer

If a developer manually modifies a resource using kubectl, they are bypassing the Git source of truth, which is the definition of a GitOps violation.

Practice this question →

MCQhard

You notice that your GitOps pipeline is stuck in a loop. What is the most likely cause?

A.The deployment process automatically commits changes back to the same Git branch that triggers the deployment.

B.The cluster is too small.

C.The Git repository contains a circular reference.

D.The container registry is offline.

AnswerA

This creates a feedback loop where each deployment triggers another deployment.

Why this answer

A loop often occurs when the GitOps operator updates the cluster, and that update triggers a process that then modifies the Git repository, creating a feedback cycle.

Practice this question →

MCQeasy

Your team is integrating a CI pipeline with a GitOps delivery model. Which of the following tasks should remain in the CI pipeline, and which should be moved to the CD/GitOps reconciliation process?

A.Everything, including image building and deployment, must be handled by the GitOps controller.

B.The CI pipeline should perform the final deployment to ensure the pipeline status is correctly reported.

C.Container image building and unit testing remain in CI, while manifest deployment to the cluster moves to GitOps.

D.Container image building moves to GitOps, while manifest deployment remains in the CI pipeline.

AnswerC

CI focuses on artifact creation and verification, while GitOps focuses on state reconciliation in the target cluster.

Why this answer

CI handles build and test; CD (GitOps) handles reconciliation and deployment.

Practice this question →

MCQmedium

Your organization uses a 'GitOps Operator' to manage deployments. What happens if a developer manually changes a configuration on the Kubernetes cluster using 'kubectl edit'?

A.The GitOps operator will enter a 'halt' state and require manual intervention to synchronize.

B.The GitOps operator will detect the drift and revert the manual change to match the configuration in Git.

C.The GitOps operator will trigger an alert, but the manual change will remain in place until the next deployment.

D.The GitOps operator will automatically update the Git repository to reflect the manual change.

AnswerB

Automated self-healing (reconciliation) is a key feature of GitOps tools.

Why this answer

The GitOps operator continuously monitors the cluster state against the Git repository; it will detect the 'out-of-sync' status and overwrite the manual change to restore the desired state.

Practice this question →

MCQmedium

What is the best way to handle temporary, non-production overrides in a GitOps environment?

A.Hardcoding all variants into the base file using if/else statements.

B.Leaving the cluster in a drifted state.

C.Editing the base manifest and pushing it.

D.Using Kustomize overlays to apply overrides on top of the base configuration.

AnswerD

This is the standard and correct way to manage environment-specific configurations.

Why this answer

Using environment-specific overlays (e.g., Kustomize) allows you to maintain clean base manifests while having specific tweaks for test environments.

Practice this question →

MCQeasy

In the context of 'Configuration as Code', why is it considered a best practice to use a declarative manifest format (like YAML) rather than imperative commands?

A.It is easier to type YAML than complex CLI commands.

B.Declarative manifests represent the desired state, allowing for automated drift detection and reconciliation.

C.YAML files are automatically encrypted by the GitOps provider.

D.Imperative commands are not supported by the Kubernetes API.

AnswerB

This is the core definition and benefit of using declarative configuration in GitOps.

Why this answer

Declarative formats describe the end state, which allows the GitOps controller to calculate the diff and drift accurately.

Practice this question →

MCQmedium

Which tool provides the most native integration for managing Kubernetes manifests using Kustomize within a GitOps workflow?

A.Terraform

B.Ansible

C.Jenkins

D.Argo CD

AnswerD

Argo CD natively supports Kustomize to render manifests before application.

Why this answer

Argo CD has native, first-class support for Kustomize overlays, allowing for environment-specific customization without needing external tools.

Practice this question →

MCQmedium

Which scenario demonstrates the most effective way to manage environment-specific configurations in a large-scale GitOps setup?

A.Creating environment-specific branches and using a templating tool to apply overrides.

B.Storing all configurations in a single large YAML file.

C.Copying and pasting the entire manifest directory for each environment.

D.Ignoring environment differences and using the same values for everything.

AnswerA

This structure keeps configurations organized and maintainable.

Why this answer

Using a templating tool like Helm or Kustomize allows you to define a base application and apply patches for different environments without duplicating the entire manifest.

Practice this question →

MCQmedium

A security auditor asks how your team handles secret management in a GitOps environment without exposing sensitive credentials in the Git repository. What is the standard GitOps practice for this requirement?

A.Use a tool like Bitnami Sealed Secrets to encrypt secrets that can be decrypted only by the cluster controller.

B.Create a separate private repository for secrets and clone it during the CI/CD pipeline execution.

C.Use Git LFS to encrypt the secret files before pushing them to the remote repository.

D.Store secrets in the repository as Base64 encoded environment variables.

AnswerA

Sealed Secrets allow secrets to be safely stored in Git while ensuring only the target cluster can decrypt them.

Why this answer

GitOps relies on tools like Sealed Secrets or external secret stores to inject credentials at runtime, keeping secrets out of the Git repository.

Practice this question →

MCQeasy

In the context of a CI/CD pipeline, where does the 'GitOps' bridge typically occur?

A.When the operator triggers the build.

B.When the developer logs into the cluster.

C.When the CI pipeline updates the manifest repository with the new image tag.

D.When the Git repo is deleted.

AnswerC

The commit to the Git repository acts as the trigger for the GitOps reconciliation loop.

Why this answer

The bridge occurs when the CI tool finishes the build and updates the Git repository with the new state, which the GitOps CD operator then picks up.

Practice this question →

MCQeasy

What is the primary role of the GitOps operator during the reconciliation phase?

A.Reporting the number of users connected to the cluster.

B.Deleting the Git repository to save space.

C.Continuously checking if the cluster matches the desired state in Git.

D.Compiling the application source code.

AnswerC

The operator ensures the cluster is always in sync with the repository.

Why this answer

The operator compares the actual state of the cluster with the desired state in Git and makes adjustments to match them.

Practice this question →

MCQmedium

When configuring a GitOps pipeline, what should be done to manage sensitive data like API keys?

A.Store them in base64 encoded format in plain Git.

B.Leave them out of Git and manually inject them via kubectl.

C.Upload them to the cluster via the cloud provider's console.

D.Use a tool like Sealed Secrets to encrypt them before committing to Git.

AnswerD

Sealed Secrets allow secrets to be safely stored in public or private Git repositories.

Why this answer

Secrets should be stored in an encrypted format (like Sealed Secrets or an external secret store) within Git so they remain secure while still being part of the declarative configuration.

Practice this question →

MCQhard

When implementing GitOps, what is the 'GitOps Operator' pattern specifically meant to solve?

A.It automates the building of Docker images.

B.It replaces the need for a Git repository.

C.It provides a user interface for cluster management.

D.It eliminates the need for any manual interaction with the cluster.

AnswerD

By automating the reconciliation, the operator ensures that the desired state is maintained without manual intervention.

Why this answer

The operator pattern solves the problem of drift by constantly reconciling the running state of the cluster with the desired state stored in version control.

Practice this question →

MCQeasy

A team is transitioning from traditional imperative scripts to declarative Configuration as Code. Which approach best satisfies the GitOps principle of using a desired state definition?

A.Using bash scripts triggered by a Jenkins build job to update environment variables.

B.Directly editing deployments via the 'kubectl edit' command.

C.Storing Kubernetes YAML manifests in a Git repository and using an operator to synchronize them.

D.Using an Ansible playbook to perform one-off configuration changes on existing servers.

AnswerC

This is the core definition of GitOps, using declarative files as the source of truth.

Why this answer

GitOps requires that the desired state be declared in a version-controlled repository to ensure traceability and auditability.

Practice this question →

Multi-Selectmedium

Which TWO of the following are common pitfalls when integrating DevSecOps into a GitOps pipeline?

Select 2 answers

A.Using multiple branches in Git.

B.Skipping vulnerability scans for Kubernetes manifests.

C.Setting up an automated reconciliation operator.

D.Storing unencrypted secrets directly in the Git repository.

E.Automating the deployment of code changes.

AnswersB, D

This allows insecure configurations to be deployed into the cluster.

Why this answer

Failing to scan the manifests in the pipeline and leaving secrets in plain text are common GitOps security failures.

Practice this question →

MCQmedium

Which practice represents the 'DevSecOps' aspect in a GitOps pipeline?

A.Conducting quarterly penetration tests.

B.Enforcing policy constraints via OPA/Gatekeeper that validate manifests against security rules.

C.Requiring a manual sign-off by a security officer for every deployment.

D.Storing secrets in plain text in the Git repository.

AnswerB

This automates security policy enforcement within the delivery flow.

Why this answer

Policy-as-code tools like OPA/Gatekeeper allow for security policies to be versioned in Git and enforced automatically during the deployment process.

Practice this question →

MCQmedium

Your organization wants to implement DevSecOps by integrating security scanning into a GitOps pipeline. Where should the vulnerability scan happen to prevent insecure configurations from ever reaching the cluster?

A.Only when an auditor requests a security report.

B.By running an automated script to delete pods that fail a security check.

C.During the CI phase, scanning the Kubernetes manifests for security misconfigurations before merging.

D.As a post-deployment check using a Kubernetes admission controller.

AnswerC

Scanning manifests in the CI pipeline allows for blocking insecure PRs before they are merged to main.

Why this answer

Shifting left means scanning code before it is applied to the cluster, ensuring the Git repository acts as a gatekeeper.

Practice this question →

MCQhard

You are managing a global cluster setup with GitOps. How do you handle configuration that must be identical across all clusters while allowing for regional variations?

A.Only having one cluster.

B.Using a base-overlay structure where the base contains common settings and overlays contain regional variations.

C.Duplicating the configuration for every cluster.

D.Using global variables in a shell script to modify manifests.

AnswerB

This is the standard, scalable way to handle shared and unique configurations.

Why this answer

Base/overlay patterns (like Kustomize) allow you to define a common base and apply regional overlays to handle unique settings.

Practice this question →

MCQeasy

In a GitOps environment, what is the main purpose of maintaining Infrastructure as Code?

A.To avoid using cloud provider dashboards.

B.To generate cost reports for the finance department.

C.To ensure that infrastructure can be defined, tracked, and automatically reconciled from Git.

D.To allow developers to log into servers and make changes.

AnswerC

IaC provides the declarative foundation necessary for GitOps.

Why this answer

IaC allows the entire infrastructure stack to be versioned, audited, and recreated reliably, mirroring the application deployment process.

Practice this question →

MCQmedium

In a GitOps environment, what is the best strategy for managing external dependencies (like Helm charts)?

A.Pinning the version of the Helm chart in your Git repository.

B.Always pulling the latest version from the remote Helm repository.

C.Ignoring the chart version and hoping it stays compatible.

D.Manually downloading the chart to every node.

AnswerA

Pinning dependencies ensures consistency across environments.

Why this answer

Storing the specific version of the Helm chart in the GitOps configuration ensures that the deployment remains reproducible.

Practice this question →

MCQmedium

When mapping traditional CI/CD to GitOps, which component from the traditional world is often 'decommissioned' or replaced?

A.The container registry.

B.The build tool (e.g., Maven/npm).

C.The Git version control system.

D.The imperative CD deployment scripts (e.g., shell scripts that run 'kubectl apply').

AnswerD

The GitOps operator replaces the need for imperative deployment scripts.

Why this answer

The 'deployment' logic in the traditional CI/CD server (like Jenkins/GitLab CI) is often replaced by the GitOps operator, which handles the deployment logic autonomously.

Practice this question →

Multi-Selecthard

Which THREE strategies are effective for managing configuration at scale in a GitOps environment?

Select 3 answers

A.Copying the entire deployment configuration for every single environment.

B.Organizing manifests into a hierarchical directory structure.

C.Using Kustomize to layer common configuration with environment-specific overrides.

D.Using Helm charts to parameterize deployments.

E.Storing all configurations in a single root-level file.

AnswersB, C, D

This allows for logical grouping and easier configuration management.

Why this answer

Scalable GitOps uses base/overlay patterns, environment-specific directories, and parameterization to keep manifests maintainable.

Practice this question →

MCQhard

How does the GitOps pattern simplify the audit process for a regulatory environment?

A.It provides a clear audit trail in Git by linking every state change to a commit and a user.

B.It moves all audit logs to the cluster memory.

C.It requires manual documentation of every change.

D.It removes the need for logs.

AnswerA

The Git log satisfies audit requirements by showing the history of all changes.

Why this answer

Git history provides an immutable log of who changed what and when, serving as a complete audit trail for compliance teams.

Practice this question →

MCQmedium

When mapping a traditional CI/CD pipeline to GitOps, what is the primary role of the CD tool?

A.Reconciling the running state of the cluster with the declarative state defined in Git.

B.Pushing binary artifacts to a server via SSH.

C.Pushing images to a container registry after a build.

D.Generating test reports for the QA team.

AnswerA

The GitOps operator continuously monitors Git and applies changes to match the desired state.

Why this answer

In GitOps, the CD tool acts as a continuous reconciler that pulls changes from Git to match the cluster state.

Practice this question →

Multi-Selectmedium

Which THREE items should be included in your Git repository for a standard GitOps setup?

Select 3 answers

A.Policy-as-Code files (e.g., OPA policies).

B.Templating definitions (Helm charts/Kustomize bases).

C.Application source code files.

D.Kubernetes manifest files (YAML).

E.The private keys for the production cluster.

AnswersA, B, D

These define the security constraints for the cluster.

Why this answer

A GitOps repository should contain the declarative manifests, template files (like Helm/Kustomize), and security policies.

Practice this question →

Multi-Selecteasy

Which TWO of the following best describe the benefits of adopting GitOps?

Select 2 answers

A.Better auditability through a full history of changes in Git.

B.Improved consistency by ensuring the cluster matches the Git state.

C.Higher speed because testing is bypassed.

D.Increased dependence on manual operator intervention.

E.The ability to run without any container registry.

AnswersA, B

Git logs provide a clear trail for compliance.

Why this answer

GitOps improves consistency and auditability by ensuring the cluster state is always managed through version control.

Practice this question →

Multi-Selecthard

Which THREE of these practices are essential to successfully transition from traditional CI/CD to GitOps?

Select 3 answers

A.Maintaining a manual 'deployment' document in a wiki.

B.Replacing imperative 'kubectl' commands with declarative manifest files.

C.Establishing Git as the sole source of truth for the environment.

D.Implementing an automated reconciliation process that pulls from Git.

E.Increasing the number of manual approvals in the CI pipeline.

AnswersB, C, D

Declarative files are required for GitOps reconciliation.

Why this answer

Successful transition requires moving away from imperative commands, adopting declarative configuration, and centralizing the source of truth.

Practice this question →

MCQhard

You are implementing a multi-environment strategy. Which Git branching strategy best supports GitOps?

A.Deleting the Git repository after each deployment to prevent tampering.

B.Using a single 'main' branch that is pushed to all environments simultaneously.

C.Using dedicated directories for each environment within a single repository.

D.Creating a new repository for every single deployment.

AnswerC

This allows for environment-specific configuration while maintaining a single source of truth.

Why this answer

Environment-specific branches or directory-based separation (using Kustomize or Helm) allow for tracking changes across dev, staging, and prod independently.

Practice this question →

Multi-Selecthard

Which TWO of the following are valid reasons to maintain a clear separation between the CI pipeline and the GitOps controller?

Select 2 answers

A.The GitOps controller is required to perform binary compilation of source code.

B.GitOps provides a continuous feedback loop and reconciliation that a one-time CI execution cannot offer.

C.The CI pipeline should not have direct write access to the Kubernetes API, limiting the blast radius of a compromised pipeline.

D.Separation allows developers to bypass the Git repository when hotfixing production.

E.The CI pipeline is physically incapable of deploying resources to a cluster.

AnswersB, C

Reconciliation is an ongoing process, whereas CI is a discrete, event-based process.

Why this answer

Separation of concerns ensures that the build pipeline focuses on artifacts and the GitOps controller focuses on state reconciliation, which also improves security by limiting cluster access.

Practice this question →