325 questions total · 5pages · All types, answers revealed
What is the primary function of an 'Operator' in the context of GitOps?
Operators continuously reconcile the live state with the desired state.
Why this answer
An operator is a Kubernetes controller that manages the lifecycle of applications by reconciling state.
What is the difference between a 'Sync' and a 'Refresh' in Argo CD?
Refresh pulls metadata; sync performs the state transition.
Why this answer
A refresh updates the application status from the Git repo, while a sync actually applies changes to the cluster.
An application is failing because a developer accidentally edited a ConfigMap in the cluster directly. Which GitOps feature prevents this from recurring?
The controller continually reconciles the cluster with Git, reverting manual changes.
Why this answer
Automated self-healing/reconciliation ensures that any direct modifications are overwritten by the Git state.
What is the impact of enabling 'selfHeal' in an Argo CD Application sync policy?
This is the definition of self-healing in Argo CD.
Why this answer
If 'selfHeal' is true, Argo CD will automatically overwrite any manual changes made to the cluster, reverting it to the Git-defined state.
How does an operator manage 'Secrets' in a GitOps repository?
Tools like SealedSecrets allow encrypted secrets to be stored in Git safely.
Why this answer
Since secrets shouldn't be in plaintext, GitOps tools use tools like SealedSecrets or external providers to inject them at runtime.
When using SOPS with Age, which THREE of the following are true regarding key management?
Allows team-based access control.
Why this answer
Age keys are file-based, can be stored as Kubernetes secrets, and allow for multiple public keys for team access.
Why would you choose to use 'Kustomize' over 'Helm' in a GitOps workflow?
Kustomize's simplicity is its primary advantage.
Why this answer
Kustomize is template-free, meaning it uses raw YAML, which is often easier to debug and avoids the 'helm hell' of deeply nested template complexity.
In a blue-green progressive delivery deployment using Flagger, you notice that the 'primary' service is not receiving traffic even after the analysis successfully completes. What is the most likely cause?
If the traffic router is not updated to point to the primary service, traffic remains on the canary or old version.
Why this answer
Flagger requires the primary service to be defined correctly for traffic shifting to occur.
You are architecting a multi-cluster deployment. What is the benefit of using an 'Operator' based architecture over a standard CI/CD Push approach in this context?
By pulling from within, the cluster does not need to expose an API endpoint to an external CI tool's service account.
Why this answer
Operator-based GitOps keeps the cluster-specific credentials inside the cluster itself, rather than needing to store them in an external CI system.
You need to ensure that no one can modify cluster resources manually. How can you implement this in a GitOps-mature organization?
This enforces the GitOps principle that all changes must flow through Git.
Why this answer
Removing manual 'write' access is the final stage of GitOps maturity, relying on the automated controller to apply changes.
Which TWO of the following are NOT recommended in a GitOps workflow?
Manual changes cause drift and bypass audit trails.
Why this answer
Manual changes and plain-text secrets are anti-patterns.
Which THREE of the following are valid ways to trigger a sync in a GitOps environment?
The operator detects the new commit and triggers the sync.
Why this answer
Syncing can be manual, automated via commit, or triggered by a webhook.
You are implementing GitOps for a legacy application. Why might this be challenging?
The effort to convert imperative installs into declarative manifests is often the biggest hurdle.
Why this answer
Legacy applications often lack declarative definitions and might require manual setup steps that are difficult to automate.
Which THREE of the following are core responsibilities of a GitOps operator?
Drift detection is the primary function of the reconciliation loop.
Why this answer
Operators are designed to observe, analyze, and act to reconcile differences.
You are using ArgoCD to deploy an application. You notice that the Application status remains 'OutOfSync' even after manual refreshes. Which feature should you examine to determine if the controller is failing to reach the cluster API?
The events log captures controller-side errors related to sync status.
Why this answer
The 'App Details' view under the 'Sync' tab or the 'Events' log in the ArgoCD UI provides specific error messages regarding API connectivity and reconciliation failures.
In a GitOps environment, what is the role of a 'CI Pipeline'?
CI acts as the gatekeeper for the source of truth.
Why this answer
The CI pipeline prepares the deployment manifests, which are then picked up by the CD GitOps operator.
Which TWO practices are recommended when managing Git repositories for GitOps?
Organizes state for different environments.
Why this answer
Best practices include using small, focused repositories and clear directory structures for environment separation.
When using OPA Gatekeeper for policy enforcement, what resource is used to define the actual logic of the policy?
This defines the Rego code for the policy.
Why this answer
A 'ConstraintTemplate' defines the Rego logic, while a 'Constraint' applies that logic to specific Kubernetes objects.
Which TWO of the following are common reasons for a deployment to be marked as 'Degraded' by Argo CD? (Select two)
If the resource fails health checks, it is 'Degraded'.
Why this answer
'Degraded' status often occurs when pods fail to start (e.g., CrashLoopBackOff) or when health checks defined in the manifest are not met.
Which THREE of the following are standard ways to organize a Git repository for a multi-tenant environment? (Select three)
This is a common way to manage multitenancy.
Why this answer
Organization patterns include project-based repos, environment-based folders, or using ApplicationSets to dynamically separate tenants.
Your organization wants to implement DevSecOps by integrating security scanning into a GitOps pipeline. Where should the vulnerability scan happen to prevent insecure configurations from ever reaching the cluster?
Scanning manifests in the CI pipeline allows for blocking insecure PRs before they are merged to main.
Why this answer
Shifting left means scanning code before it is applied to the cluster, ensuring the Git repository acts as a gatekeeper.
You are managing a global cluster setup with GitOps. How do you handle configuration that must be identical across all clusters while allowing for regional variations?
This is the standard, scalable way to handle shared and unique configurations.
Why this answer
Base/overlay patterns (like Kustomize) allow you to define a common base and apply regional overlays to handle unique settings.
In a GitOps environment, what is the main purpose of maintaining Infrastructure as Code?
IaC provides the declarative foundation necessary for GitOps.
Why this answer
IaC allows the entire infrastructure stack to be versioned, audited, and recreated reliably, mirroring the application deployment process.
Which THREE of the following represent key concepts in 'GitOps'?
IaC is the core foundation for GitOps manifests.
Why this answer
GitOps is defined by declarative infrastructure, version control, and automated reconciliation.
Which GitOps tool provides a dedicated CLI called 'argocd'?
The 'argocd' CLI is the standard interaction tool.
Why this answer
ArgoCD provides a powerful CLI tool for interacting with the ArgoCD API, managing applications, and checking sync states.
What does the status 'OutOfSync' indicate in Argo CD?
This status signifies a discrepancy between desired and actual state.
Why this answer
It means the live state of the resources in the cluster does not match the desired state in the Git repository.
Which THREE of the following are common challenges when scaling GitOps to hundreds of clusters? (Select three)
If not configured properly, empty repos can trigger unintended removals.
Why this answer
Scaling challenges include managing the overhead of the controller, handling secret distribution, and ensuring that temporary outages do not lead to massive drift across the fleet.
If you want to view the history of changes made to your cluster configuration, where should you look in a GitOps model?
The commit history is the canonical log of every change made to the system.
Why this answer
Because Git is the source of truth, the git log provides a complete history of all configuration changes.
When evaluating ArgoCD vs Flux, which TWO of the following are distinct advantages of using Flux?
Flux is composed of specialized controllers.
Why this answer
Flux is known for its modular controller-based architecture and its ability to handle multi-repo environments effectively without a centralized UI overhead.
Which THREE of the following are benefits of using a GitOps operator for CD?
The operator ensures the cluster is always in the target state.
Why this answer
Operators provide continuous, secure, and automated deployment.
An organization is implementing GitOps across its infrastructure using Kubernetes and Flux. Which TWO statements accurately describe core characteristics of the 'Automated Pull-Based Reconciliation' principle?
Continuous drift detection and self-healing correction are fundamental aspects of the pull-based reconciliation loop.
Why this answer
In automated pull-based reconciliation, an in-cluster agent monitors the target state in Git and compares it to live state, pulling updates without exposing external cluster inbound management ports.
Which TWO tools are commonly associated with the 'GitOps' ecosystem?
Leading GitOps controller.
Why this answer
Argo CD and Flux are the two most prominent Kubernetes-native GitOps controllers.
In a large enterprise, why is GitOps preferred for multi-cluster environments?
This minimizes configuration drift and ensures standardized environments.
Why this answer
GitOps allows a single repository to define the state for multiple clusters, ensuring consistency across environments.
In a GitOps environment, what is the best strategy for managing external dependencies (like Helm charts)?
Pinning dependencies ensures consistency across environments.
Why this answer
Storing the specific version of the Helm chart in the GitOps configuration ensures that the deployment remains reproducible.
A developer updates a Helm release values file in Git to change a ConfigMap key. How does the GitOps pull-based agent determine that reconciliation is necessary?
Continuous comparison of the desired state in Git (tracked via commit SHAs) against the observed live state drives the reconciliation loop.
Why this answer
The pull-based GitOps agent periodically polls or receives webhooks from the Git repository, comparing the target Git revision (SHA or tag) and contents against the current state stored/deployed in the cluster.
When configuring Kyverno policies to secure a cluster, which TWO of the following actions can a policy perform?
Policies can perform validation/mutation.
Why this answer
Kyverno policies can block unauthorized changes (enforce) or simply log them for reporting purposes (audit).
When mapping traditional CI/CD to GitOps, which component from the traditional world is often 'decommissioned' or replaced?
The GitOps operator replaces the need for imperative deployment scripts.
Why this answer
The 'deployment' logic in the traditional CI/CD server (like Jenkins/GitLab CI) is often replaced by the GitOps operator, which handles the deployment logic autonomously.
Which TWO of the following are primary benefits of adopting a GitOps 'Pull' model compared to a 'Push' model? (Choose two)
Credentials stay internal, reducing the attack surface.
Why this answer
Pull models enhance security by removing the need for external access to the cluster and improve reliability through continuous, self-healing reconciliation.
Which THREE of the following are essential tasks when implementing SOPS with GitOps?
Required for encryption/decryption.
Why this answer
You must create the encryption key, integrate with the GitOps tool (Flux/Argo), and ensure the key is available to the controller as a Secret.
Which TWO of the following are true about ArgoCD ApplicationSets?
Can deploy to multiple clusters based on rules.
Why this answer
ApplicationSets automate the generation of applications and support multi-cluster deployment via generators.
Which THREE of the following are common GitOps tools used in the CNCF ecosystem?
Enables GitOps for infrastructure management.
Why this answer
Argo CD, Flux, and Crossplane are recognized GitOps-focused tools.
Which TWO of the following configurations are necessary to ensure that GitOps-managed clusters in a multi-cluster setup remain isolated from one another? (Select TWO)
Namespace isolation is critical for preventing cross-application interference.
Why this answer
Using dedicated AppProjects per cluster and strict namespace-level RBAC ensures that GitOps controllers cannot accidentally deploy or interfere with resources in unauthorized clusters.
What is the recommended way to handle secrets in GitOps?
SealedSecrets keeps the secret encrypted in Git, decryptable only in the cluster.
Why this answer
Secrets should never be stored in plaintext. Tools like SealedSecrets or HashiCorp Vault integration are standard.
Which THREE strategies are effective for managing configuration at scale in a GitOps environment?
This allows for logical grouping and easier configuration management.
Why this answer
Scalable GitOps uses base/overlay patterns, environment-specific directories, and parameterization to keep manifests maintainable.
When a GitOps tool reports a 'Sync Error', what is the most likely cause?
Malformed YAML prevents the API server from accepting the resource.
Why this answer
Sync errors often result from resource conflicts or permission issues when applying manifests.
When setting up a multi-cluster GitOps pattern, what is the benefit of using 'Cluster Labels' in ApplicationSets?
This enables flexible and automated cluster management.
Why this answer
Cluster labels allow you to dynamically select which clusters to deploy to based on attributes (e.g., env=prod), providing a scalable way to target subsets of your infrastructure.
In an ArgoCD environment, you notice that a specific set of resources is being ignored during sync. What field in the 'argocd-cm' ConfigMap or the Application manifest is likely responsible?
This field explicitly tells ArgoCD to ignore specified fields.
Why this answer
The 'ignoreDifferences' field allows users to exclude specific fields or resource paths from the sync reconciliation process.
In a GitOps workflow, how does an operator handle a situation where a user manually deletes a resource that is defined in Git?
The operator identifies that the live state is missing the resource and applies the Git manifest.
Why this answer
The reconciliation loop detects the absence of the resource and redeploys it to match the source of truth.
How does the GitOps pattern simplify the audit process for a regulatory environment?
The Git log satisfies audit requirements by showing the history of all changes.
Why this answer
Git history provides an immutable log of who changed what and when, serving as a complete audit trail for compliance teams.
When mapping a traditional CI/CD pipeline to GitOps, what is the primary role of the CD tool?
The GitOps operator continuously monitors Git and applies changes to match the desired state.
Why this answer
In GitOps, the CD tool acts as a continuous reconciler that pulls changes from Git to match the cluster state.
In GitOps, what does 'Self-Healing' mean?
This is the definition of GitOps self-healing.
Why this answer
Self-healing refers to the ability of the GitOps controller to automatically detect drift and revert the cluster to the state defined in Git.
Which THREE mechanisms can be used to notify a GitOps controller of a change in Git?
Efficient, event-driven notification.
Why this answer
Controllers can detect changes via polling (continuous), webhooks (event-driven), or manual sync requests.
Which THREE items should be included in your Git repository for a standard GitOps setup?
These define the security constraints for the cluster.
Why this answer
A GitOps repository should contain the declarative manifests, template files (like Helm/Kustomize), and security policies.
You are debugging a GitOps deployment. The controller shows 'OutOfSync' but the cluster seems to be running correctly. What is the most likely cause?
This is the classic definition of configuration drift in GitOps.
Why this answer
An 'OutOfSync' status indicates that the actual cluster configuration deviates from the declarative state defined in Git.
Which of the following is considered 'best practice' for GitOps repository structure?
Separating environment config allows for cleaner promotion flows.
Why this answer
Separating application code from infrastructure/environment configuration is a GitOps best practice.
When managing multiple environments (dev/stage/prod) in one repository, which folder structure is generally considered best practice?
This is the industry-standard structure for GitOps repositories.
Why this answer
Keeping environment configurations in separate folders (e.g., /overlays/dev, /overlays/prod) allows for clear separation and prevents accidental configuration bleeding.
Which THREE are standard ways to implement GitOps with Helm?
Modern GitOps tools integrate this natively.
Why this answer
Helm can be used by packaging charts in Git, using a GitOps operator to render templates, or by storing values files in Git.
An administrator notices that an engineer manually modified a Service loadBalancerIP in the Kubernetes live cluster using 'kubectl edit'. The cluster is managed by an automated GitOps engine configured in a pull-based model. What will happen during the next reconciliation cycle?
Continuous drift correction enforces the state in Git over any out-of-band manual changes made to the cluster.
Why this answer
In a pull-based GitOps pattern, an agent running inside the cluster continuously monitors both the declared state in Git and the actual state in the cluster. When drift is detected, the controller overwrites the live state with the desired state defined in Git.
You are comparing GitOps deployment models. Which scenario best describes a 'Pull' deployment model?
Flux pulls the configuration from Git and applies it locally, adhering to the Pull model.
Why this answer
In a Pull model, an agent inside the cluster (like Flux or Argo CD) periodically fetches the desired state from a repository, eliminating the need for external access to the cluster's API.
Which of the following is NOT a benefit of the GitOps model?
GitOps improves consistency and manageability, not raw compute performance.
Why this answer
GitOps does not necessarily increase the performance of the underlying application; it focuses on deployment and configuration consistency.
What is a 'GitOps Operator'?
The operator is the heart of the GitOps pull-based loop.
Why this answer
An operator is a Kubernetes controller that implements a control loop to continuously reconcile the cluster with the desired state in Git.
In a multi-cluster GitOps setup using Argo CD, you need to ensure that specific secrets are only synced to a production cluster. Which approach is the most secure?
Argo CD Projects allow for strict destination constraints, ensuring secrets only reach authorized cluster destinations.
Why this answer
Using External Secrets Operator with cluster-specific namespaces or Argo CD Project-level restrictions allows you to segregate secret access effectively.
You are debugging an ArgoCD sync failure. You find the 'Sync Status' is 'Failed'. Where is the most detailed error information located?
This shows the specific error returned by the API server during the sync operation.
Why this answer
The 'Sync' tab in the ArgoCD UI provides the 'Sync Result' and 'Resource Details', which show specific error outputs from the Kubernetes API server.
Which TWO of the following best describe the benefits of adopting GitOps?
Git logs provide a clear trail for compliance.
Why this answer
GitOps improves consistency and auditability by ensuring the cluster state is always managed through version control.
What is the relationship between the 'desired state' and the 'actual state' in GitOps?
Reconciliation bridges the gap between the two states.
Why this answer
The goal of GitOps is to make the actual state equal to the desired state.
Which TWO of the following are primary benefits of storing immutable state in Git?
Declarative files in Git replace manual, error-prone configurations.
Why this answer
Immutability and versioning provide a clear audit trail and reliable rollback mechanisms.
You are managing secrets using SOPS with Age. You notice that Flux cannot decrypt the files. What is the most likely cause?
Flux must be able to read the private key from a Secret to decrypt files.
Why this answer
Flux needs access to the private key (stored as a Kubernetes Secret) to decrypt SOPS-encrypted files during reconciliation.
When migrating from ArgoCD to Flux, you want to replicate the 'Sync Waves' behavior. Which Flux feature provides equivalent control over the order of resource reconciliation?
The dependsOn field allows defining the order of reconciliation for Kustomizations.
Why this answer
Flux uses the 'dependsOn' field in the Kustomization resource to define ordered dependencies between objects.
Which TWO are examples of 'Drift' in a GitOps environment?
This is classic configuration drift.
Why this answer
Drift is any change to the cluster state that is not reflected in the Git repository.
In GitOps, what should happen if a configuration file is deleted from the Git repository?
The operator ensures the cluster perfectly mirrors the repo.
Why this answer
The operator will reconcile the state by deleting the corresponding resource from the cluster.
If you have a multi-cluster setup and you want to ensure that 'production' clusters only pull images from a hardened internal registry, how can you enforce this in GitOps?
This provides automated and consistent enforcement.
Why this answer
Using Admission Controllers (e.g., OPA Gatekeeper or Kyverno) triggered by the GitOps deployment ensures that only images from approved registries are admitted into the cluster.
A senior cloud architect is designing a multi-tenant platform using GitOps. They want to ensure that continuous drift detection and correction operate reliably without causing system instability. Which TWO practices help mitigate risks associated with automated continuous drift correction?
Ignoring fields modified by cluster operators prevents continuous reconciliation loops between the GitOps engine and live cluster controllers.
Why this answer
Automated drift correction can cause feedback loops or resource exhaustion if external mutations (like auto-scalers modifying replica counts or controllers adding status annotations) conflict with Git. Ignoring dynamic runtime fields or using structured sync windows mitigates these risks.
You are implementing a GitOps pipeline for a complex microservices architecture. To satisfy the principle of 'versioned and immutable state', how should you handle environment-specific configurations while maintaining a single source of truth?
Kustomize allows for a declarative, versioned approach to managing variants while keeping a single source of truth.
Why this answer
Using Kustomize bases and overlays allows for a single declarative base while versioning environment-specific patches separately in Git, maintaining immutability.
In GitOps, what is the 'Source of Truth'?
Git is the declarative definition of the state.
Why this answer
The Git repository is the single source of truth for the desired state of the infrastructure and applications.
Which TWO of the following are true about the 'Pull' model in GitOps? (Select two)
This is a key security advantage.
Why this answer
The pull model uses an internal controller to fetch desired state from Git, which is more secure and reliable than pushing from an external CI system.
Practice CGOA by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →