325 questions total · 5pages · All types, answers revealed
Which of these is a typical 'Desired State' artifact in GitOps?
YAML manifests define the expected state of the cluster.
Why this answer
Kubernetes manifest files, Helm charts, or Kustomize templates are the standard ways to define declarative state.
What is the primary risk of a 'Push-based' deployment model compared to 'Pull-based'?
This creates a 'God-mode' credential issue.
Why this answer
Push-based models require the CI system to have cluster-admin credentials, creating a significant security vulnerability if the CI system is compromised.
Your team is integrating a CI pipeline with a GitOps delivery model. Which of the following tasks should remain in the CI pipeline, and which should be moved to the CD/GitOps reconciliation process?
CI focuses on artifact creation and verification, while GitOps focuses on state reconciliation in the target cluster.
Why this answer
CI handles build and test; CD (GitOps) handles reconciliation and deployment.
What happens if the Git repository is temporarily unavailable during a sync cycle?
Operators are designed to be resilient and will retry after failures.
Why this answer
The operator will fail to fetch, and the application will remain in its last known state, usually showing a sync error.
In a GitOps promotion pipeline, why is it recommended to tag container images with a unique Git commit SHA instead of 'latest'?
SHA-based tagging is essential for reliable GitOps.
Why this answer
Using the Git commit SHA provides traceability and immutability. 'Latest' is a mutable tag that can point to different versions over time, making rollbacks impossible.
Your organization uses a 'GitOps Operator' to manage deployments. What happens if a developer manually changes a configuration on the Kubernetes cluster using 'kubectl edit'?
Automated self-healing (reconciliation) is a key feature of GitOps tools.
Why this answer
The GitOps operator continuously monitors the cluster state against the Git repository; it will detect the 'out-of-sync' status and overwrite the manual change to restore the desired state.
What is the primary function of the 'reconciliation loop' in GitOps?
This is the core definition of the GitOps reconciliation loop.
Why this answer
The reconciliation loop ensures that the current cluster state matches the desired state defined in Git.
If a GitOps controller detects that an image tag has been changed in the cluster but not in Git, what does the controller do?
Continuous drift correction ensures the live state returns to the desired state.
Why this answer
The controller identifies this as drift and uses the Git source of truth to revert the image tag back to the version declared in Git.
Which term best describes the process of ensuring the live cluster matches the desired state stored in Git?
Syncing is the act of aligning the actual state with the target state.
Why this answer
Syncing or Reconciliation is the process of applying the Git-defined state to the cluster.
How does GitOps help with disaster recovery?
This is the essence of 'reproducible infrastructure'.
Why this answer
Because the entire cluster state is defined in Git, you can simply point a new cluster to the repository to recreate the environment.
Which THREE of the following are common tasks performed by a GitOps Operator? (Choose three)
The operator executes the necessary changes to match Git.
Why this answer
The operator watches Git for changes, reconciles the live state, and provides visibility into drift/sync status.
When deploying across multiple clusters using Argo CD, you need to ensure that specific secrets are only available to clusters located in the 'us-east' region. Which resource should you use to enforce this segregation?
AppProject allows you to define destination restrictions, including cluster and namespace whitelisting.
Why this answer
Argo CD AppProject objects are designed specifically to restrict cluster access and namespace access, making them the correct tool for multi-cluster security and segregation.
You are troubleshooting a Flux installation. The operator is failing to pull updates from a private GitHub repository. What component is most likely misconfigured?
The GitRepository object refers to a secret containing authentication credentials; if missing or incorrect, the operator cannot fetch the repo.
Why this answer
Flux uses Kubernetes Secrets to store the SSH keys or tokens required for authentication with Git providers.
Which TWO of the following are features of progressive delivery in GitOps? (Select two)
This minimizes risk by exposing only a subset of users.
What does the 'prune' setting in a GitOps controller do?
Pruning keeps the live state clean by removing orphaned objects.
Why this answer
Pruning ensures that resources not present in Git are removed from the cluster.
Which THREE of the following actions occur during an ArgoCD sync operation?
Diff generation phase.
Why this answer
The controller fetches the latest from Git, compares the live state to Git (diff), and applies updates to the cluster.
Which THREE of the following are essential components of an effective GitOps 'Continuous Drift Detection and Correction' strategy?
Reconciliation is the engine of drift detection.
Why this answer
Drift detection requires a continuous comparison (reconciliation) between Git and the live cluster, alerting on differences, and optionally auto-remediating them.
What is the best way to handle temporary, non-production overrides in a GitOps environment?
This is the standard and correct way to manage environment-specific configurations.
Why this answer
Using environment-specific overlays (e.g., Kustomize) allows you to maintain clean base manifests while having specific tweaks for test environments.
Which TWO of the following are valid strategies for promoting an application from staging to production in GitOps? (Select two)
This is a standard promotion practice.
Why this answer
Promotion strategies include changing the Git reference (branch/tag) or updating the values file within a single repository path.
Which TWO of the following are common GitOps terminology used to describe the state of an application?
The state described in Git.
Why this answer
'Desired' vs 'Live' (or 'Current') are standard terms in GitOps.
Which of these is a valid 'GitOps' approach for multi-environment management?
This is the standard, clean pattern for multi-environment GitOps.
Why this answer
Using different folders or branches for environment-specific configurations allows for clear separation and controlled deployments.
What is the primary benefit of version controlling your cluster manifests?
Version control is the foundation for reliable change management.
Why this answer
Version control provides an audit trail, rollback capability, and consistency.
You are using Kustomize 'overlays' for environment promotion. If you need to add a specific label to all resources in production but not in staging, where should you define it?
The overlay is the correct location for environment-specific customizations.
Why this answer
Kustomize overlays are designed to layer changes on top of a base. The production overlay allows for patching or adding specific labels that don't exist in the base.
What is the primary benefit of using a 'Git Branch' promotion pattern over a 'Directory-based' promotion pattern?
Branch isolation allows for formal review processes per environment, reducing the risk of configuration drift.
Why this answer
Branch-based promotion allows for better isolation of changes, enabling PR reviews for individual environments and preventing accidental merges to production.
You are managing a large-scale deployment using the App-of-Apps pattern in Argo CD. Which resource type do you primarily use as the parent application to reference child application manifests?
An Application resource acts as the parent container that synchronizes sub-applications.
Why this answer
The App-of-Apps pattern uses a root Application resource that points to a directory or Git repository containing multiple other Application resources.
You are using Flux and need to ensure that specific resources are ignored by the reconciliation process. Which feature should you utilize?
These annotations instruct the Flux controller to skip specific resources during sync.
Why this answer
Flux allows using annotations to mark resources as 'ignore' or 'skip' to prevent the operator from modifying them.
What is the purpose of the 'SealedSecrets' custom resource?
It wraps secrets into an encrypted CRD.
Why this answer
It provides a way to commit encrypted secrets into Git that can only be decrypted by a controller running in the target cluster.
You have a GitOps pipeline where you want to promote a change from Staging to Production. Using Argo CD, what is the recommended way to perform this promotion?
This follows the GitOps principle of declarative state changes in Git.
Why this answer
Updating the image tag or configuration in the Production folder/branch within the Git repository is the standard GitOps way to trigger a promotion, as it maintains Git as the single source of truth.
In the context of 'Configuration as Code', why is it considered a best practice to use a declarative manifest format (like YAML) rather than imperative commands?
This is the core definition and benefit of using declarative configuration in GitOps.
Why this answer
Declarative formats describe the end state, which allows the GitOps controller to calculate the diff and drift accurately.
An organization uses Argo CD to manage Kubernetes clusters. A developer manually modifies a Deployment's replica count via kubectl. Which mechanism in Argo CD ensures this manual change is identified as non-compliant with the GitOps repository?
The Argo CD controller continuously polls the cluster and Git to detect drift.
Why this answer
Argo CD continuously compares the live state of the cluster with the desired state defined in Git. When a discrepancy is detected, it reports the status as 'OutOfSync', performing drift detection.
What does 'Declarative Configuration' imply in GitOps?
GitOps relies on manifests to define the target state.
Why this answer
It means specifying the desired state in files rather than using imperative commands.
Which THREE of the following are essential security practices for GitOps? (Select three)
This is foundational for secure operations.
Why this answer
GitOps security relies on repository access controls, secret management, and policy enforcement (like OPA) to ensure the system remains compliant.
What does the status 'Healthy' mean in an Argo CD application?
Health is the assessment of the live, running workload.
Why this answer
A 'Healthy' status indicates that the application is running as intended in the cluster.
Which tool provides the most native integration for managing Kubernetes manifests using Kustomize within a GitOps workflow?
Argo CD natively supports Kustomize to render manifests before application.
Why this answer
Argo CD has native, first-class support for Kustomize overlays, allowing for environment-specific customization without needing external tools.
You are configuring Flux to manage a multi-tenant cluster. You need to ensure that specific namespaces only allow images from an internal registry. Which tool should you use to enforce this at admission time?
Kyverno policies can validate image registry sources during admission.
Why this answer
Kyverno is a Kubernetes-native policy engine that can restrict image registries via admission controllers.
Which of the following is a core principle of GitOps?
This is the foundational definition of GitOps.
Why this answer
GitOps defines the desired state in a version-controlled repository, which acts as the 'single source of truth'.
What is the primary role of the 'Reconciler' in a GitOps operator?
This is the core loop of GitOps operators.
Why this answer
The reconciler continuously monitors the cluster and the target state (Git), identifying differences and applying actions to make the cluster match the Git definition.
You are using Argo CD. A developer manually scales a Deployment replica count using 'kubectl scale'. What happens next in a standard GitOps implementation?
This is the core behavior of automated drift correction.
Why this answer
The GitOps controller detects a mismatch between the live state and the Git-defined desired state and automatically reverts it.
Which THREE of the following are benefits of the 'App-of-Apps' pattern? (Select three)
The parent can coordinate the rollout of children.
Why this answer
App-of-Apps simplifies large scale management, allows for grouping of related services, and enables hierarchical control of GitOps deployments.
A developer pushes a change to Git, but the cluster does not update. Which log source is most effective for debugging the pull-based mechanism?
The controller is responsible for pulling the state and applying it.
Why this answer
The controller logs contain information about the reconciliation process, including authentication or parsing errors.
In a GitOps environment using Argo CD, what is the primary purpose of the reconciliation loop?
The operator continuously polls Git to ensure the live state matches the desired state.
Why this answer
The reconciliation loop constantly compares the desired state in Git to the actual state in the cluster to identify and address configuration drift.
Which scenario demonstrates the most effective way to manage environment-specific configurations in a large-scale GitOps setup?
This structure keeps configurations organized and maintainable.
Why this answer
Using a templating tool like Helm or Kustomize allows you to define a base application and apply patches for different environments without duplicating the entire manifest.
A security auditor asks how your team handles secret management in a GitOps environment without exposing sensitive credentials in the Git repository. What is the standard GitOps practice for this requirement?
Sealed Secrets allow secrets to be safely stored in Git while ensuring only the target cluster can decrypt them.
Why this answer
GitOps relies on tools like Sealed Secrets or external secret stores to inject credentials at runtime, keeping secrets out of the Git repository.
Which TWO of the following are key features of the Flux Kustomization controller?
Core function of the controller.
Why this answer
The Kustomization controller reconciles manifests and supports post-build variable substitution.
What is the primary role of an 'Immutable' state in a GitOps repository?
Immutability is key to reproducible environments and quick recovery.
Why this answer
Immutability ensures that once a state is recorded, it cannot be tampered with, and historical states are reproducible.
In the context of a CI/CD pipeline, where does the 'GitOps' bridge typically occur?
The commit to the Git repository acts as the trigger for the GitOps reconciliation loop.
Why this answer
The bridge occurs when the CI tool finishes the build and updates the Git repository with the new state, which the GitOps CD operator then picks up.
Which TWO of the following are standard GitOps workflows for promoting changes?
Promoting by file/folder change is a common pattern.
Why this answer
Promotion usually happens by updating manifests in different directories or branches.
What is the primary role of the GitOps operator during the reconciliation phase?
The operator ensures the cluster is always in sync with the repository.
Why this answer
The operator compares the actual state of the cluster with the desired state in Git and makes adjustments to match them.
Why does GitOps encourage the use of small, frequent commits?
This is a standard DevOps and GitOps practice for risk reduction.
Why this answer
Small commits make it easier to identify the cause of failures, simplify rollbacks, and reduce the risk of large-scale outages.
When configuring a GitOps pipeline, what should be done to manage sensitive data like API keys?
Sealed Secrets allow secrets to be safely stored in public or private Git repositories.
Why this answer
Secrets should be stored in an encrypted format (like Sealed Secrets or an external secret store) within Git so they remain secure while still being part of the declarative configuration.
What is the primary function of an 'ApplicationSet' in Argo CD?
ApplicationSets simplify management for large-scale environments.
Why this answer
ApplicationSets allow for the automated generation of one or more applications from a single template, based on generators like Cluster, List, or Git.
An organization is migrating to GitOps using Argo CD. During an audit, you notice that manual changes made directly to the Kubernetes cluster via kubectl are being reverted within minutes. Which component of the GitOps pipeline is performing this action?
The Application Controller is responsible for the continuous reconciliation loop that detects and corrects drift.
Why this answer
The Application Controller in Argo CD continuously monitors the live state and compares it against the declared state in Git, initiating a sync to fix drift.
When should you use Kustomize in a GitOps workflow?
Kustomize allows for 'base' and 'overlay' patterns perfectly suited for GitOps.
Why this answer
Kustomize is excellent for managing environment-specific configurations without duplicating base manifests.
What is a 'GitOps Operator'?
Continuous reconciliation is the core function of a GitOps operator.
Why this answer
An operator is a Kubernetes controller that continuously reconciles the cluster state with a source of truth in a Git repository.
Which of the following is a primary benefit of using a GitOps pull-based model over a push-based CI/CD model?
The cluster controller pulls from Git, so credentials stay within the cluster boundary.
Why this answer
Pull-based models increase security by eliminating the need to expose cluster credentials to external CI/CD pipelines.
You are implementing a GitOps workflow where the desired state is stored in a private repository. The Argo CD controller requires access to this repository. What is the most secure GitOps-compliant way to provide this access?
This method follows the principle of least privilege and keeps credentials out of source control.
Why this answer
Using a Kubernetes Secret to store repository credentials allows for secure, native integration with the Argo CD controller.
What happens when a resource's 'SyncPolicy' is set to 'Manual'?
Manual sync requires an explicit user action.
Why this answer
The operator will detect the drift, but it will not automatically apply the changes to the cluster until a user clicks 'Sync'.
What is the primary role of the 'Git' repository in the GitOps cycle?
Every change must be in Git to be reflected in the cluster.
Why this answer
It serves as the single source of truth for the entire cluster configuration.
You are using Argo Rollouts for progressive delivery. You want to execute a 'AnalysisRun' before switching traffic. Where is the 'AnalysisTemplate' defined?
These are managed as standard K8s manifests.
Why this answer
The AnalysisTemplate is a Kubernetes resource that defines the metric queries and thresholds. It is often stored in the same Git repository as the application manifests.
In a multi-cluster GitOps environment, you are using the ApplicationSet controller with a 'Cluster Generator'. You need to add a new cluster dynamically without modifying the ApplicationSet manifest. How should you achieve this?
Argo CD automatically discovers clusters defined by these secrets.
Why this answer
The Cluster Generator can watch for new Kubernetes Secrets with the label 'argocd.argoproj.io/secret-type: cluster'. Once a new secret is added with this label, the controller automatically detects it and deploys the applications.
Your team wants to implement GitOps. Which of the following is a critical prerequisite for 'Drift Detection' to be effective?
Comparison requires access to both the source (Git) and the target (Cluster).
Why this answer
For an operator to detect drift, it must be able to periodically compare the live state in the cluster against the specific declarative manifests stored in Git.
When implementing multi-cluster GitOps, which THREE components are critical for success? (Select three)
This is required for the controller to talk to the API server.
Why this answer
A robust multi-cluster strategy requires a centralized management plane, a way to handle environment-specific differences, and secure connectivity between the hub and spoke clusters.
When implementing GitOps, what is the 'GitOps Operator' pattern specifically meant to solve?
By automating the reconciliation, the operator ensures that the desired state is maintained without manual intervention.
Why this answer
The operator pattern solves the problem of drift by constantly reconciling the running state of the cluster with the desired state stored in version control.
Which THREE features of Kubernetes are commonly used to support GitOps?
The mechanism for applying state.
Why this answer
GitOps relies on the Kubernetes API, Namespaces for isolation, and RBAC to secure the controller's access.
Which THREE of the following are effective ways to handle 'Configuration Drift' in a GitOps environment? (Select three)
This prevents drift before it happens.
Why this answer
Drift can be managed by enabling self-healing, using admission controllers to block non-Git changes, and regular auditing/monitoring of the sync status.
A team is transitioning from traditional imperative scripts to declarative Configuration as Code. Which approach best satisfies the GitOps principle of using a desired state definition?
This is the core definition of GitOps, using declarative files as the source of truth.
Why this answer
GitOps requires that the desired state be declared in a version-controlled repository to ensure traceability and auditability.
Which of these is the most suitable tool to use as the 'Git' component of GitOps?
Git's branching, merging, and history are fundamental to GitOps.
Why this answer
Any standard Git-compatible server like GitHub, GitLab, or Bitbucket provides the necessary features for GitOps.
When promoting an application from staging to production using the 'GitOps directory' pattern, what is the most robust way to ensure environment-specific configurations are applied correctly?
Overlays are the standard GitOps pattern for maintaining environment-specific differences from a common base.
Why this answer
Using Kustomize overlays allows for a base configuration with environment-specific patches, ensuring no drift between environments.
Which TWO of the following are common pitfalls when integrating DevSecOps into a GitOps pipeline?
This allows insecure configurations to be deployed into the cluster.
Why this answer
Failing to scan the manifests in the pipeline and leaving secrets in plain text are common GitOps security failures.
Which TWO of the following are essential when using Helm in a GitOps workflow? (Select two)
This is required for environment promotion.
Why this answer
GitOps with Helm requires versioning charts and tracking the specific values files used for each deployment environment.
When using Kyverno, which THREE of the following can be used to validate Kubernetes resources?
Allows complex validation rules.
Why this answer
Kyverno uses patterns, variable expressions, and conditional logic to define validation rules.
Which TWO of the following are common benefits of using a 'GitOps Operator'? (Select two)
This is a key benefit.
Why this answer
Operators provide continuous reconciliation of state and enable declarative management, reducing manual operational burden.
Which practice represents the 'DevSecOps' aspect in a GitOps pipeline?
This automates security policy enforcement within the delivery flow.
Why this answer
Policy-as-code tools like OPA/Gatekeeper allow for security policies to be versioned in Git and enforced automatically during the deployment process.
You are configuring an automated GitOps pipeline. How do you prevent 'drift' from occurring due to out-of-band changes?
Self-healing forces the cluster to align with the Git-defined desired state.
Why this answer
Enabling automated self-healing (or auto-sync) in the GitOps controller ensures that any unauthorized cluster changes are automatically reverted.
Which mechanism is used in a GitOps workflow to ensure that a 'Canary' deployment successfully rolls back if error rates spike?
These templates define the thresholds and rollback logic for progressive delivery.
Why this answer
Flagger monitors metrics via a provider (e.g., Prometheus) during the canary phase. If thresholds are exceeded, it automatically triggers a rollback to the previous version.
Practice CGOA by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →