How should I use these Tooling practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Tooling questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Tooling domain.

CGOA · topic practice

Tooling practice questions

Practise Certified GitOps Associate (CGOA, CNCF/Linux Foundation) (CGOA) Tooling practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Tooling

Practice 10 questions Browse domain →

What the exam tests

What to know about Tooling

Tooling questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Tooling exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Tooling questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Tooling explanation →

You are configuring Flux to manage a multi-tenant cluster. You need to ensure that specific namespaces only allow images from an internal registry. Which tool should you use to enforce this at admission time?

Trap 1: ArgoCD Notifications

Notifications provide alerts but do not block unauthorized resource creation.

Trap 2: Sealed Secrets

Sealed Secrets is strictly for secret management.

Trap 3: Flux Image Automation Controller

This controller handles image updates, not runtime admission policy.

Tooling practice questions

What to know about Tooling

Common Tooling exam traps

Tooling questions

You are configuring Flux to manage a multi-tenant cluster. You need to ensure that specific namespaces only allow images from an internal registry. Which tool should you use to enforce this at admission time?

You are using ArgoCD and need to ensure that secret values stored in Git via Sealed Secrets are decrypted only within the target cluster. What component performs the actual decryption of a SealedSecret resource?

You are using OPA Gatekeeper with GitOps. You want to prevent any deployment that does not have an 'owner' label. Where should this policy be applied to ensure it is enforced for all GitOps-driven changes?

When migrating from ArgoCD to Flux, you want to replicate the 'Sync Waves' behavior. Which Flux feature provides equivalent control over the order of resource reconciliation?

Which GitOps tool relies primarily on a pull-based model utilizing the 'Source Controller' and 'Kustomization' custom resources?

Your organization requires that all Kubernetes manifest changes be signed and encrypted before being pushed to Git. Which tool is primarily designed for this 'at-rest' encryption approach?

In an ArgoCD environment, you notice that a specific set of resources is being ignored during sync. What field in the 'argocd-cm' ConfigMap or the Application manifest is likely responsible?

You are using ArgoCD to deploy an application. You notice that the Application status remains 'OutOfSync' even after manual refreshes. Which feature should you examine to determine if the controller is failing to reach the cluster API?

Which of the following is a key advantage of using a 'pull' based GitOps model (like Flux or ArgoCD) over a 'push' based CI/CD pipeline?

You are using Flux with Kustomize. You want to apply different configurations for production and staging, but both use the same base manifests. Which Kustomize feature allows this?

You are managing secrets using SOPS with Age. You notice that Flux cannot decrypt the files. What is the most likely cause?

You have a large ArgoCD installation and want to limit the blast radius. Which feature allows you to restrict which namespaces an application can deploy to?

An ArgoCD application is configured with 'SelfHeal' set to true. If a developer manually modifies a Deployment's replica count via kubectl, what happens?

You are using ArgoCD and need to inject a value into a manifest that is not present in Git, such as a temporary credential. Which feature would you use to do this dynamic injection?

When troubleshooting a Kyverno policy, which command should you use to check if a specific resource complies with the policy?

What is the primary function of the Flux Image Reflector Controller?

What is the purpose of the 'SealedSecrets' custom resource?

You are debugging an ArgoCD sync failure. You find the 'Sync Status' is 'Failed'. Where is the most detailed error information located?

Which of these is a primary reason for using Helm charts in a GitOps workflow?

Which GitOps tool provides a dedicated CLI called 'argocd'?

Track your progress over time

Start a Tooling only practice session

Related CGOA topic practice pages

Gitops Principles practice questions

Gitops Terminology practice questions

Tooling practice questions

Gitops Patterns practice questions

Related Practices practice questions

CGOA fundamentals practice questions

CGOA scenario practice questions

CGOA troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid