I85PREP
⌘ K
CGOA study materials
CGOA study resources

CGOA practice questions

One question at a time. Build your CGOA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1GitOps Terminology

In GitOps terminology, what is the desired state?

  1. The event log produced by the reconciliation controller
  2. The live resources currently running in the cluster
  3. The declarative configuration stored in the Git repository Correct answer.
  4. The container images cached on each node

Explanation

The desired state is the declarative description of the system held in version control, typically manifests or Helm/Kustomize output committed to Git. Controllers read this state and work to make the cluster match it.

Question 2GitOps Terminology

What does the observed state mean in a GitOps workflow?

  1. The state of the Git branch protection rules
  2. The actual condition of resources currently in the cluster Correct answer.
  3. The state that operators intend to deploy next sprint
  4. The state recorded in the pull request review history

Explanation

Observed state is what the reconciler reads from the live environment at a given moment, such as the current spec and status of deployed objects. Comparing it to desired state drives corrective action.

Question 3GitOps Terminology

Which statement best defines reconciliation in GitOps?

  1. The archival of old commits for audit purposes
  2. The process of merging feature branches into main
  3. The manual approval step required before any deployment
  4. The continuous comparison and convergence of live state toward desired state Correct answer.

Explanation

Reconciliation is the control loop that detects drift between desired and observed state and applies changes to close the gap. It runs continuously rather than as a one-time deployment step.

Question 4GitOps Terminology

What is drift in GitOps terminology?

  1. The delay between a commit and its CI pipeline start
  2. A Git rebase conflict between two contributors
  3. A difference between the desired state in Git and the live cluster state Correct answer.
  4. The lag in metrics scraping intervals

Explanation

Drift occurs when the live environment diverges from what is declared in the source of truth, often due to manual changes or failed syncs. Controllers detect drift during reconciliation and can revert it.

Question 5GitOps Terminology

In GitOps, what is the source of truth?

  1. The authoritative version-controlled repository holding the desired configuration Correct answer.
  2. The on-call runbook wiki
  3. The container registry manifest list
  4. The production database replica

Explanation

The source of truth is the Git repository (or an equivalent versioned store) that authoritatively defines desired state. Everything deployed should be traceable back to a commit in that repository.

Question 6GitOps Terminology

What is a sync in GitOps tooling such as Argo CD?

  1. The periodic rotation of credentials
  2. The act of cloning the repository to a developer laptop
  3. The process of tagging a release in Git
  4. The operation that applies desired state from Git to the live environment Correct answer.

Explanation

A sync applies the declared manifests to the cluster so the live state matches the source of truth. It can be triggered manually or automatically by the controller.

Question 7GitOps Terminology

Which term describes a GitOps agent that continuously enforces the declared state inside a cluster?

  1. Scheduler
  2. Autoscaler
  3. Ingress controller
  4. Reconciler Correct answer.

Explanation

A reconciler is the agent or controller that watches desired state and drives the cluster toward it. In pull-based GitOps it runs inside the cluster and pulls configuration from the repository.

Question 8GitOps Terminology

What distinguishes a pull-based GitOps model from a push-based one?

  1. Developers manually copy manifests onto cluster nodes
  2. A CI job uses kubectl credentials to apply manifests to the cluster
  3. An agent inside the cluster fetches desired state from the repository Correct answer.
  4. The repository pushes webhooks that mutate Git history

Explanation

In pull-based GitOps, an in-cluster agent retrieves configuration from the repository and applies it, so cluster credentials never leave the environment. Push-based models instead have an external pipeline apply changes directly.

Question 9GitOps Terminology

A team edits a Deployment directly with kubectl, and the GitOps controller later restores the manifest from Git. Which concept does this illustrate?

  1. Drift correction Correct answer.
  2. Rolling back a release tag
  3. Blue-green cutover
  4. Version skew

Explanation

The manual edit created drift between live and desired state, and the controller corrected it by reapplying the declared configuration. This automatic correction is the core promise of reconciliation.

Question 10GitOps Terminology

In Argo CD terminology, what is an Application resource?

  1. A custom resource mapping a Git source and path to a target cluster and namespace Correct answer.
  2. A Kubernetes namespace reserved for GitOps workloads
  3. A Helm chart repository index
  4. A CI pipeline definition stored in the cluster

Explanation

An Application declares where the desired manifests live and where they should be deployed, binding source to destination. The controller uses it to determine what to reconcile.

Question 11GitOps Terminology

What does self-heal mean in a GitOps controller's configuration?

  1. The controller automatically reverts live changes that diverge from Git Correct answer.
  2. The controller rebuilds container images on commit
  3. The controller restarts crashed pods after a node failure
  4. The controller scales replicas during traffic spikes

Explanation

Self-heal enables the controller to automatically correct drift by reapplying desired state when live resources are modified or deleted. It does not cover image building or node-level recovery.

Question 12GitOps Terminology

What is automated pruning in a GitOps sync policy?

  1. Cleaning up old container layers on nodes
  2. Deleting stale branches from the repository
  3. Compressing manifests before applying them
  4. Removing live resources that no longer exist in the desired state Correct answer.

Explanation

Pruning deletes cluster resources whose manifests have been removed from Git, keeping the environment aligned with the source of truth. Without pruning, orphaned resources persist and cause drift.

Question 13GitOps Terminology

A manifest is committed but the controller reports the Application as OutOfSync. What does this status indicate?

  1. The Git repository is unreachable
  2. The live state differs from the desired state Correct answer.
  3. The Application has been deleted from Git
  4. The cluster has run out of CPU capacity

Explanation

OutOfSync means the comparison between desired and live state found differences that have not yet been applied. Sync status reflects state equality, not connectivity or capacity.

Question 14GitOps Terminology

In GitOps terminology, what is an environment in a typical repository layout?

  1. A branch protection rule set
  2. A Kubernetes API group version
  3. A shell variable set in the CI runner
  4. A distinct target deployment context such as staging or production Correct answer.

Explanation

An environment denotes a separate deployment target with its own configuration, commonly represented by a directory or overlay per environment. Promotion means moving a validated change from one environment to the next.

Question 15GitOps Terminology

What does promotion mean in a GitOps delivery flow?

  1. Tagging a container image as latest
  2. Granting a developer write access to the main branch
  3. Advancing a validated change from one environment to another via version control Correct answer.
  4. Increasing the replica count in production

Explanation

Promotion moves a change through environments, typically by updating the desired state for the next environment in Git. Because it is a commit, the promotion is auditable and reversible.

Question 16GitOps Terminology

Which practice is most consistent with GitOps principles for changing production configuration?

  1. Disabling reconciliation so manual changes persist
  2. Submitting a pull request that updates the manifest, then letting the controller sync it Correct answer.
  3. Editing the live ConfigMap with kubectl during an incident and documenting it later
  4. SSHing into a node to patch the kubelet config

Explanation

GitOps requires all changes to flow through the versioned source of truth, so a reviewed pull request followed by reconciliation keeps the audit trail intact. Direct live edits create drift and are reverted by self-heal.

Question 17GitOps Terminology

What is the role of a webhook in a pull-based GitOps setup?

  1. It enforces branch protection on the default branch
  2. It signs container images before deployment
  3. It notifies the controller that the repository changed so a sync can start promptly Correct answer.
  4. It replaces the reconciler by applying manifests itself

Explanation

A webhook shortens the feedback loop by telling the in-cluster agent that a new commit exists, prompting an immediate comparison instead of waiting for the next poll. The agent still performs the reconciliation.

Question 18GitOps Terminology

Which statement correctly contrasts continuous delivery with continuous deployment in a GitOps context?

  1. Continuous deployment forbids version control, while continuous delivery requires it
  2. Continuous delivery applies only to databases, while continuous deployment applies to stateless services
  3. Continuous delivery uses push models, while continuous deployment uses only pull models
  4. Continuous delivery requires manual approval before production release, while continuous deployment releases automatically Correct answer.

Explanation

Both models keep the mainline deployable, but continuous delivery gates the final production release behind a human decision, whereas continuous deployment promotes automatically once checks pass. GitOps reconciliation can support either model.

Question 19GitOps Terminology

In GitOps terminology, what is a rendered manifest?

  1. The kubectl output printed after a failed apply
  2. The final YAML produced after templating or overlaying a source configuration Correct answer.
  3. The Git commit message describing a deployment
  4. The raw Helm chart values file committed by a developer

Explanation

A rendered manifest is the concrete output produced when tools such as Helm or Kustomize expand templates and overlays into applyable YAML. Controllers compare this rendered form against live state.

Question 20GitOps Terminology

An engineer asks why a GitOps controller reports Healthy but OutOfSync at the same time. Which explanation is most accurate?

  1. Health reflects whether resources are functioning, while sync reflects whether live state matches Git Correct answer.
  2. The two statuses are synonyms reported by different controllers
  3. Health reflects Git connectivity, while sync reflects pod readiness
  4. OutOfSync always implies the application is unhealthy

Explanation

Health and sync are independent dimensions: an application can be running correctly yet differ from the declared configuration, for example after a manual edit. Reconciliation will eventually close the sync gap.

Question 21GitOps Terminology

A team stores environment-specific overrides in separate branches and merges them only at release time. Which GitOps concern does this pattern most directly create?

  1. Container images can no longer be pulled by the cluster
  2. The source of truth for an environment becomes ambiguous and hard to audit Correct answer.
  3. The controller loses the ability to read Kubernetes APIs
  4. TLS certificates expire faster

Explanation

Long-lived divergent branches make it unclear which commit defines an environment's desired state, weakening auditability and promotion traceability. GitOps layouts usually keep environments in directories or overlays on a single mainline instead.

Question 22GitOps Terminology

During an incident, an operator scales a Deployment manually and the GitOps controller immediately reverts it. Which configuration change would allow a temporary exception while preserving GitOps discipline?

  1. Disabling the controller cluster-wide until the incident ends
  2. Deleting the Git repository and recreating it after the incident
  3. Removing the Application resource from the cluster
  4. Committing an override to the desired state through the normal review path Correct answer.

Explanation

GitOps allows exceptions as long as they are expressed in the source of truth, so a reviewed commit keeps the audit trail and lets reconciliation enforce the intended override. Disabling enforcement or deleting resources abandons the model.

Question 23GitOps Terminology

Which scenario best demonstrates why pruning must be enabled alongside automated sync?

  1. A manifest is renamed in Git and the old resource remains live, causing duplicate routing Correct answer.
  2. A secret is rotated by an external vault
  3. A new namespace is created by the controller
  4. A container image tag changes and pods restart

Explanation

When a manifest is removed or renamed, only pruning deletes the corresponding live object; otherwise the orphan persists and may keep serving traffic. Automated sync alone applies new objects but does not remove stale ones.

Question 24GitOps Terminology

A platform team wants cluster credentials to remain inside the cluster while still deploying on every commit. Which GitOps design satisfies both requirements?

  1. A developer workstation that watches Git and applies manifests manually
  2. A cron job on a bastion host that runs helm upgrade with admin credentials
  3. A CI pipeline that holds a kubeconfig and runs kubectl apply on each commit
  4. An in-cluster agent that polls or receives webhooks and pulls manifests from Git Correct answer.

Explanation

Pull-based GitOps keeps credentials in-cluster because the agent fetches desired state rather than an external system pushing with cluster access. Webhooks can still provide prompt triggering without exposing credentials.

Question 25GitOps Terminology

Two Applications point at the same namespace, one managing a Deployment and the other managing a Service with the same name label selector. What GitOps design issue does this raise?

  1. The namespace must be recreated for each Application
  2. Sync waves are disabled automatically
  3. Shared ownership of a target can cause controllers to fight over resources Correct answer.
  4. Helm charts cannot be used in shared namespaces

Explanation

Overlapping ownership means multiple reconcilers may apply conflicting desired states to the same objects, producing repeated drift and unpredictable results. GitOps layouts should assign clear ownership boundaries per Application.

Question 26GitOps Terminology

In GitOps terminology, what does the desired state of a system refer to?

  1. The cached snapshot held in the controller's memory
  2. The live configuration currently running in the cluster
  3. The output produced by the last reconciliation run
  4. The configuration stored declaratively in the Git repository Correct answer.

Explanation

Desired state is the declarative description of what the system should look like, and in GitOps it lives in version-controlled Git. The cluster's running configuration is the observed or actual state, which the agent compares against the desired state.

Question 27GitOps Terminology

Which statement best describes the GitOps principle of declarative configuration?

  1. The system's intended state is expressed as data describing the end result Correct answer.
  2. Operators issue imperative commands that the agent records as a change log
  3. Each deployment step is scripted as an ordered list of cluster API calls
  4. Configuration is generated at runtime from the current cluster inventory

Explanation

Declarative means the configuration describes the end result the system should reach, rather than the sequence of actions to get there. The agent is then free to determine how to converge on that described state.

Question 28GitOps Terminology

What is the source of truth in a GitOps workflow?

  1. The cluster's etcd key-value store
  2. The controller's reconciliation log
  3. The CI pipeline's build artifacts
  4. The Git repository holding the declarative manifests Correct answer.

Explanation

In GitOps the version-controlled repository is the single source of truth for desired state; everything else is derived from or compared against it. Changes flow from Git to the cluster, never the reverse as an authoritative record.

Question 29GitOps Terminology

Which term describes the continuous process by which a GitOps agent compares desired state in Git with live cluster state and acts to close any gap?

  1. Orchestration
  2. Federation
  3. Serialization
  4. Reconciliation Correct answer.

Explanation

Reconciliation is the loop that reads desired state from Git, observes the live cluster, and applies or reverts changes so the two converge. It is the core mechanism that makes GitOps self-correcting.

Question 30GitOps Terminology

A GitOps repository separates a base directory of shared manifests from overlay directories that patch them per environment. Which terminology from Kustomize-style layouts does this describe?

  1. Base and overlays Correct answer.
  2. Branches and tags
  3. Stages and gates
  4. Forks and remotes

Explanation

A base holds the common manifests, and overlays apply environment-specific patches on top of that base without duplicating the whole definition. This is the standard way GitOps repositories avoid copy-paste drift across environments.

Question 31GitOps Terminology

In GitOps vocabulary, what is drift?

  1. The version skew between the agent and the Kubernetes API server
  2. The divergence between two Git branches tracking the same environment
  3. The delay between a commit landing in Git and the agent noticing it
  4. The difference between the declared desired state and the live cluster state Correct answer.

Explanation

Drift is any divergence between what Git declares and what actually runs in the cluster, whether caused by manual edits or external controllers. Detecting and correcting drift is the central value proposition of GitOps.

Question 32GitOps Terminology

What does convergence mean when applied to a GitOps-managed cluster?

  1. The live state has been brought into agreement with the desired state in Git Correct answer.
  2. The repository has been merged into the main branch after review
  3. The agent has finished installing its own control-plane components
  4. The cluster has been scaled to match its configured node count

Explanation

Convergence describes the outcome of reconciliation: live state now matches the declared desired state. A converged application is typically reported as synced and healthy.

Question 33GitOps Terminology

An engineer refers to an Argo CD Application's destination. What does that term identify?

  1. The target cluster and namespace where manifests are deployed Correct answer.
  2. The notification channel that reports sync results
  3. The container registry that stores the built images
  4. The Git repository and path holding the manifests

Explanation

The destination names the target cluster and namespace the Application deploys into, while the source names the repository and path. Keeping these distinct is essential when reading Application specs.

Question 34GitOps Terminology

What is a GitOps manifest in the context of a repository?

  1. A file declaring the desired Kubernetes resources in a machine-readable format Correct answer.
  2. A signed document authorizing a deployment to production
  3. A changelog entry describing what a release contains
  4. A script that applies resources in a fixed order

Explanation

A manifest is a declarative file, usually YAML or JSON, describing the resources that should exist. The agent reads these files as the desired state rather than executing them as scripts.

Question 35GitOps Terminology

A team adopts a GitOps model in which the agent runs inside the cluster and pulls changes from Git. Which term describes the state where the agent has applied the latest commit and live resources match it?

  1. Suspended
  2. Degraded
  3. Synced Correct answer.
  4. Superseded

Explanation

Synced means the live state has been updated to match the desired state from the latest source revision. It is a statement about agreement between Git and the cluster, separate from whether the workload is healthy.

Question 36GitOps Terminology

What is a GitOps agent's health status intended to convey?

  1. Whether the deployed resources are functioning correctly after being applied Correct answer.
  2. Whether the repository has been cloned successfully
  3. Whether the agent has permission to read secrets
  4. Whether the commit signature has been verified

Explanation

Health reflects the runtime condition of applied resources, such as whether a Deployment's pods are available. It answers a different question than sync status, which concerns agreement with Git.

Question 37GitOps Terminology

Which term describes a GitOps pattern where a single repository contains both the application source code and the deployment manifests, with CI updating the manifests in the same repo?

  1. Federated multi-cluster deployment
  2. Immutable image promotion
  3. Blue-green cutover
  4. Monorepo with co-located manifests Correct answer.

Explanation

Co-locating manifests with source in one repository is a monorepo pattern, which simplifies change tracking but can blur the boundary between build and deploy. Many teams instead split application and deployment repositories to separate those concerns.

Question 38GitOps Terminology

A platform team distinguishes between a GitOps environment repository and an application repository. What is the primary purpose of the environment repository?

  1. To store integration test results for each release
  2. To host the agent's configuration for authentication providers
  3. To compile application source code into container images
  4. To hold the manifests that define what is deployed to each environment Correct answer.

Explanation

An environment repository, sometimes called a deployment or config repository, holds the per-environment desired state that agents watch. It is the deployment source of truth, distinct from where application code is built.

Question 39GitOps Terminology

An operator says a change was made through the GitOps backdoor. What does that phrase most likely mean?

  1. A change was deployed to a staging environment first
  2. A change was applied directly to the cluster, bypassing Git Correct answer.
  3. A change was rolled back by reverting a commit
  4. A change was merged without a pull request review

Explanation

A backdoor change bypasses the Git source of truth by editing the cluster directly, which produces drift and will typically be reverted by reconciliation. The term highlights the risk of circumventing the declared workflow.

Question 40GitOps Terminology

Two teams argue about whether an Application is the unit of deployment or the cluster is. In GitOps terminology, which statement is most accurate?

  1. The Application is a runtime object that replaces the need for namespaces
  2. The cluster is the unit only when manifests are stored outside Git
  3. The cluster is the only unit, since agents reconcile entire clusters at once
  4. The Application is a declarative grouping that binds a source to a destination for reconciliation Correct answer.

Explanation

An Application binds a source of manifests to a destination cluster and namespace, giving the agent a scoped unit to reconcile. Clusters host many such units, so the two are not competing definitions of the same thing.

Question 41GitOps Principles

In GitOps, what is the authoritative source of truth for the desired state of the system?

  1. The live cluster's current resource objects
  2. The CI pipeline's build artifacts
  3. The Git repository holding the declarative manifests Correct answer.
  4. The on-call engineer's runbook wiki

Explanation

GitOps defines the desired state declaratively and stores it in a version-controlled Git repository, which becomes the single source of truth. The live cluster is the observed state that must be reconciled toward that desired state, not the authority itself.

Question 42GitOps Principles

Which property of Git most directly enables GitOps to provide a complete audit trail of infrastructure changes?

  1. Pull request templates
  2. Git hooks
  3. Immutable commit history Correct answer.
  4. Branch protection rules

Explanation

Git records every change as an immutable commit with author, timestamp, and diff, so the history of desired state is auditable and tamper-evident. Branch protection, templates, and hooks are workflow conveniences layered on top but do not themselves create the audit log.

Question 43GitOps Principles

A platform team wants drift in production to be corrected automatically without a human running kubectl apply. Which GitOps mechanism achieves this?

  1. A webhook that notifies chat when a commit lands
  2. A reconciliation loop that continuously compares and syncs cluster state to Git Correct answer.
  3. A scheduled CI job that rebuilds container images
  4. A manual approval gate before each deploy

Explanation

GitOps relies on an in-cluster agent running a reconciliation loop that continuously observes live state and converges it to the declared state in Git, correcting drift without human intervention. CI image builds and notifications do not enforce desired state.

Question 44GitOps Principles

In the four GitOps principles, what does "declarative" mean for the desired state?

  1. The state is expressed as an ordered list of imperative commands
  2. The state must be regenerated by a script on every sync
  3. The state describes the end result rather than the steps to reach it Correct answer.
  4. The state is written only in a domain-specific templating language

Explanation

Declarative configuration specifies what the system should look like, and the reconciler determines how to get there. Imperative scripts describe the steps, which is the opposite of the declarative requirement.

Question 45GitOps Principles

What distinguishes a pull-based GitOps deployment from a push-based one?

  1. The agent inside the cluster pulls the desired state from Git and applies it Correct answer.
  2. The registry pulls images into the cluster on a schedule
  3. The CI system pushes credentials into the cluster before each deploy
  4. The developer pushes manifests directly with kubectl from a laptop

Explanation

In pull-based GitOps an agent running in the cluster fetches desired state from Git and reconciles locally, so cluster credentials never leave the cluster. Push-based models have an external system apply changes into the cluster.

Question 46GitOps Principles

Why does GitOps treat the Git repository as the only place from which cluster changes should originate?

  1. Because Git automatically encrypts all secrets
  2. Because Git is faster than the Kubernetes API server
  3. Because any out-of-band change would make Git an inaccurate record of desired state Correct answer.
  4. Because Kubernetes refuses to accept changes not committed to Git

Explanation

If changes are made outside Git, the repository no longer reflects reality and reconciliation will revert them or hide the divergence, breaking the audit trail. GitOps therefore requires all changes to flow through Git.

Question 47GitOps Principles

An operator agent is deployed with read-only access to Git and read-write access to the cluster. Which GitOps principle does this access model best support?

  1. Continuous reconciliation with least-privilege credential flow Correct answer.
  2. Manual change approval
  3. Multi-cluster federation
  4. Imperative deployment scripting

Explanation

Pull-based agents need only read access to Git and the rights to reconcile the cluster, which keeps credentials inside the cluster and supports continuous reconciliation with least privilege. The other options describe unrelated capabilities.

Question 48GitOps Principles

Which statement best captures the GitOps principle of continuous reconciliation?

  1. Reconciliation happens only during business hours
  2. Reconciliation is triggered solely by a human operator
  3. Software agents continuously observe and converge actual state to desired state Correct answer.
  4. Reconciliation runs once after each merge and then stops

Explanation

Continuous reconciliation means agents keep comparing observed state to the declared state and correcting divergence at any time, including drift caused by external actors. One-shot or human-triggered syncs do not satisfy the principle.

Question 49GitOps Principles

A team stores environment-specific overlays in separate directories and uses a tool to render them into a single desired state per environment. Which GitOps practice does this illustrate?

  1. Storing cluster state only in the API server
  2. Using a single branch for all environments with no separation
  3. Environment promotion via a shared declarative base with per-environment overlays Correct answer.
  4. Imperative hotfixing of production directly

Explanation

Declarative bases with per-environment overlays let teams promote changes by merging into the appropriate environment directory while keeping a single source of truth. This is a standard GitOps structuring pattern.

Question 50GitOps Principles

After a manual change is made directly to a running Deployment, the GitOps agent detects a difference and reverts it within minutes. What is this behavior called?

  1. Canary analysis
  2. Blue-green deployment
  3. Immutable infrastructure
  4. Drift correction Correct answer.

Explanation

Drift is divergence between observed and desired state; the agent's automatic reversion is drift correction, a direct consequence of continuous reconciliation. The other terms describe deployment strategies, not divergence handling.