Linux Foundation CGOA Certified GitOps Associate Exam Exam Practice Test

GitOps requires apull-based approachas the default model, where agents in the cluster automatically pull desired state from Git. However,push-based triggers(e.g., webhooks) can optionally be used to complement pull-based reconciliation.

“Pull-based reconciliation is required in GitOps to ensure automation and security. Push-based triggers may optionally complement this, but the pull model is fundamental.”

Thus, the correct answer isD.

GitOps enhancesDevSecOpsby ensuring security-related configurations and changes are stored in version control, where acomplete audit historyis available. This provides traceability, accountability, and compliance enforcement.

“With GitOps, the entire version history of desired state changes is stored immutably in Git. This audit trail supports security and compliance goals in DevSecOps practices.”

Thus, the correct answer isB.

In GitOps, rollback is performed by reverting the system’sDesired Statestored in Git. This is done with thegit revertcommand, which creates a new commit that undoes the changes introduced by a previous commit.

“Because Git provides an immutable history of changes, rollbacks are straightforward. Reverting to a previous configuration is accomplished by reverting the commit in Git, which then allows the reconciler to apply the earlier desired state.”

Thus, the correct answer isB: git revert.

In GitOps, thedesired stateis stored in Git. Manual updates applied directly to the cluster (via kubectl or APIs) change theactual statewithout updating Git. This introducesdriftbetween actual and desired state.

“Manual changes to the runtime environment cause the actual state to diverge from the desired state stored in Git. This drift must be detected and reconciled automatically.”

Thus, the correct answer isC.

TheState Storeis typically implemented using aversion control system (VCS)such as Git. This ensures that the system’s state is auditable, versioned, and immutable. Other systems like databases or distributed file systems do not meet the immutability and versioning requirements of GitOps.

“In GitOps, the desired state must be stored in a version control system. This serves as the State Store, providing a complete, immutable, and auditable history of changes.”

Thus, the correct answer isD: version control system.

ArgoCD and Flux are the two primary CNCF GitOps tools. While both are reconciliation engines, they can be used together carefully if configured properly to avoid conflicts. For example, Flux can be used to manage configuration sources, while ArgoCD handles application-level delivery. Extensions and integration points allow them to complement each other.

“ArgoCD and Flux implement the GitOps reconciliation principle. Though they provide overlapping functionality, they can be integrated by carefully managing their scope. For instance, Flux can manage sources and Helm charts, while ArgoCD handles higher-level deployments. Extensions exist to allow cooperation without conflict.”

Thus, the correct answer isC.

In GitOps,DevSecOpsintegrates security into the GitOps workflow by treating security policies as code and storing them in Git. This enables automatic detection ofsecurity policy driftand ensures that any misconfiguration or violation is reconciled, just like application and infrastructure code.

“GitOps applies DevSecOps by managing security policies as code. This enables detection of drift in security configurations, ensuring environments remain compliant and secure.”

Thus, the correct answer isA.

In GitOps,Git is the single source of truth. If changes are made manually in the cluster (viakubectl), those changes will drift from the desired state in Git. To ensure consistency, the correct approach is toupdate the Git repository (Desired State store)so that the reconciler can continuously apply and maintain those changes.

“The desired state must always be declared in Git. Manual changes in the cluster will be overwritten by reconciliation unless they are committed to the Git repository.”

Thus, the correct answer isB.

ACanary Deploymentgradually introduces a new application version to a small subset of users before expanding to the full user base. This pattern allows testing and validation in production while reducing risk.

“Canary deployments progressively roll out changes to a small group of users, monitoring for issues before routing all traffic to the new version. This gradual shift minimizes risk and ensures safer releases.”

Thus, the correct answer isB.

One of the four core GitOps principles is that the system must beContinuously Reconciled. This means reconciliation is not a one-time or on-demand process but happensconstantlyin the background, ensuring the actual system state remains aligned with the declared desired state.

“GitOps requires that reconciliation is continuous. Software agents continuously compare actual state against desired state and automatically reconcile differences.”

Thus, the correct answer isC.

Kustomize is a GitOps tool for managing Kubernetes configurations declaratively. It uses afolder structure with configuration filesand akustomization.yamlfile that references resources and overlays. This enables customization without modifying the base manifests.

“Kustomize allows customization of Kubernetes manifests by organizing resources in directories and referencing them through file paths in a kustomization file. This directory-based approach supports overlays, reusability, and modular configuration.”

Thus, the correct answer isD.

DevSecOpsintegrates security into the DevOps culture and CI/CD pipelines. Instead of treating security as an afterthought, DevSecOps ensures security checks, policies, and automated validations are embedded throughout the CI/CD process.

“DevSecOps emphasizes shifting security left, integrating security testing, validation, and compliance into every stage of the CI/CD pipeline. This ensures vulnerabilities are detected early and software is delivered securely.”

Thus,Dis correct: DevSecOps culture is essential for CI/CD pipelines to ensure security is baked into software delivery.

Whendriftoccurs (actual state diverges from desired state), GitOps controllers attempt to reapply theDesired Statestored in Git. The system is always converged toward what Git declares, never the other way around.

“In case of drift, the reconciler re-applies the desired state from Git to the runtime environment, ensuring the actual system matches the declared configuration.”

Thus, the correct answer isB.

ThePulled Automaticallyprinciple in GitOps means that agents inside the runtime environment (e.g., controllers/operators) continuously monitor Git (the source of truth) andautomatically pull changeswhen updates are detected.

“Software agents continuously pull changes from the version control system and reconcile them automatically. This pull-based approach ensures automation, security, and self-healing.”

Thus, the correct answer isB.

In aBlue-Green deployment, two environments (Blue and Green) exist at the same time. The current version runs in one environment (Blue), and the new version is deployed to the other environment (Green). Traffic is switched to Green once the new version is validated.

“Blue-Green deployments maintain two production environments. The new version is deployed alongside the old version, and once validated, traffic is switched from Blue to Green.”

Thus, the correct answer isC.

One of the four fundamental GitOps principles isVersioned and Immutable. This means that the entire system’s desired state must be stored in a Git repository with version control. Each change must be represented as a commit, and Git’s immutability guarantees a reliable, auditable history of how the system evolved.

“The desired state is stored in a version control system. The record of truth is stored in an immutable history, and changes can be audited and reverted if necessary. This guarantees that the system’s configuration is versioned, immutable, and traceable.”

Thus,configuration and infrastructure must be version-controlled and immutable, never changed directly in production.

AGitOps-managed software systemis defined as one or more runtime environments whose resources are managed declaratively via GitOps practices.

“A GitOps-managed software system includes one or more runtime environments, such as clusters, where resources are under management. The desired state of these resources is declared in Git and reconciled continuously.”

Thus, the correct option isB.

Kustomizeis a Kubernetes-native configuration management tool that allows manifest customization without modifying the original YAML files. It uses overlays and patches to adapt configurations for different environments.

“Kustomize provides a declarative way to customize Kubernetes manifests by applying patches and overlays. This allows managing multiple environments without duplicating manifest files.”

Thus, the correct answer isD.