Related Practices practice questions

Because Git stores all application logs.

Why wrong: Git is not a log aggregation tool.

Because it is the only tool that supports branching.

Why wrong: Other version control systems support branching.

Because Git automatically runs the applications.

Why wrong: Git stores the code, it does not execute the application.

To avoid using cloud provider dashboards.

Why wrong: While true, it is not the primary purpose.

To generate cost reports for the finance department.

Why wrong: IaC is for configuration, not accounting.

To allow developers to log into servers and make changes.

Why wrong: Direct access should be restricted in a GitOps environment.

Only when an auditor requests a security report.

Why wrong: Security should be continuous, not periodic.

By running an automated script to delete pods that fail a security check.

Why wrong: This is reactive and can cause service instability.

As a post-deployment check using a Kubernetes admission controller.

Why wrong: This catches issues after deployment, which is a secondary defense, not the primary pipeline gate.

Execute Terraform via a CI job that triggers Argo CD after completion.

Why wrong: This creates a disconnected process where infrastructure state is not tracked by the GitOps operator.

Manually trigger Terraform runs before pushing new app manifests to Git.

Why wrong: Manual intervention breaks the GitOps loop and creates configuration drift.

Embed Terraform binary execution within a K8s deployment container.

Why wrong: This is an anti-pattern that complicates state management and container security.

Pushing binary artifacts to a server via SSH.

Why wrong: This is a traditional push-based CD pattern, not GitOps.

Pushing images to a container registry after a build.

Why wrong: This is part of the CI phase.

Generating test reports for the QA team.

Why wrong: This is a reporting function, not a deployment reconciliation function.

The container registry is unreachable during a new image rollout.

Why wrong: This leads to an 'ImagePullBackOff', not configuration drift.

The Git repository contains syntax errors in the YAML files.

Why wrong: Syntax errors would cause the reconciliation to fail and log an error, not drift.

The CI pipeline failed to run tests.

Why wrong: CI test failure prevents merges, it does not cause runtime drift.

Conducting quarterly penetration tests.

Why wrong: This is a compliance activity, not a pipeline-integrated DevSecOps practice.

Requiring a manual sign-off by a security officer for every deployment.

Why wrong: This is a bottleneck and not automated.

Storing secrets in plain text in the Git repository.

Why wrong: This is a critical security failure.

Using bash scripts triggered by a Jenkins build job to update environment variables.

Why wrong: This is an imperative approach rather than declarative.

Directly editing deployments via the 'kubectl edit' command.

Why wrong: This bypasses version control and does not use Infrastructure as Code.

Using an Ansible playbook to perform one-off configuration changes on existing servers.

Why wrong: Ansible is often imperative unless strictly managed with idempotent roles in a GitOps workflow.

Deleting the Git repository after each deployment to prevent tampering.

Why wrong: GitOps relies on the history contained in the repository.

Using a single 'main' branch that is pushed to all environments simultaneously.

Why wrong: This lacks environment-specific configuration management.

Creating a new repository for every single deployment.

Why wrong: This creates unmanageable repository sprawl.

Having the CD operator pull the 'latest' tag directly from the registry.

Why wrong: Using 'latest' is an anti-pattern as it is not immutable and makes rollbacks difficult.

Manually updating the YAML file with the new image tag and committing to Git.

Why wrong: This is manual and error-prone, counter to GitOps automation principles.

Triggering a shell script to update the cluster state directly from the CI pipeline.

Why wrong: This bypasses the GitOps operator's reconciliation loop.

It eliminates the need for container registries.

Why wrong: Container registries are still required for the images themselves.

You can use fewer Git branches.

Why wrong: Branching strategy is independent of the pull vs push mechanism.

The CI system runs faster.

Why wrong: Speed is not the primary benefit; security and reliability are.

Store them in base64 encoded format in plain Git.

Why wrong: Base64 is not encryption and is easily decoded; this is insecure.

Leave them out of Git and manually inject them via kubectl.

Why wrong: This breaks the GitOps workflow and creates configuration drift.

Upload them to the cluster via the cloud provider's console.

Why wrong: Manual injection creates undocumented state.

Configuration as Code is only for databases.

Why wrong: Configuration as Code applies to any software service.

Config as Code is always written in YAML.

Why wrong: It can be in various formats, though YAML is common in Kubernetes.

They are the same thing.

Why wrong: They are distinct layers in the stack.

Terraform

Why wrong: Terraform is for infrastructure, not for managing Kubernetes application manifests.

Ansible

Why wrong: Ansible is for configuration management, not Kubernetes native reconciliation.

Jenkins

Why wrong: Jenkins is a generic CI tool and does not natively manage GitOps reconciliation.

Delete the pods and let the operator recreate them.

Why wrong: This doesn't fix the underlying configuration error.

Stop the GitOps operator to prevent it from correcting the state.

Why wrong: This disables the GitOps workflow entirely.

Run 'kubectl rollout undo' on the deployment.

Why wrong: The operator will likely overwrite this change because it doesn't match the state in Git.

It causes high latency in the cluster.

Why wrong: Tag mutability is a consistency risk, not a performance risk.

The GitOps operator cannot detect changes.

Why wrong: The operator can detect changes, but the outcome is unpredictable.

It consumes too much disk space.

Why wrong: Image tag naming does not affect disk storage.

Secrets are encrypted in the Git repo.

Why wrong: This is a best practice.

The cluster automatically reconciles changes pushed to Git.

Why wrong: This is a core GitOps principle.

Developers use PRs to propose changes to the environment.

Why wrong: This is a core GitOps workflow.

Storing all configurations in a single large YAML file.

Why wrong: This is impossible to manage at scale.

Copying and pasting the entire manifest directory for each environment.

Why wrong: This creates maintenance nightmares and configuration drift.

Ignoring environment differences and using the same values for everything.

Why wrong: Environments often require different resource limits, replicas, or endpoints.

When the operator triggers the build.

Why wrong: The operator does not trigger the build.

When the developer logs into the cluster.

Why wrong: Developers shouldn't log into the cluster.

When the Git repo is deleted.

Why wrong: The repo must persist.

It moves all audit logs to the cluster memory.

Why wrong: Cluster memory is ephemeral and not suitable for audits.

It requires manual documentation of every change.

Why wrong: GitOps automates the tracking, reducing the need for manual documentation.

It removes the need for logs.

Why wrong: GitOps does not remove the need for logs.