All CompTIA exams
Free AT0-001 practice test: 30 questions with answers
30 original questions for CompTIA AutoOps+, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.
- Free questions
- 30
- Full bank
- 112 questions
- Real exam
- 60 questions, 60 min
- Passing score
- 600 (scale 100-900)
All 30 AT0-001 questions with answers
The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.
Automation Coding Concepts (8 questions)
Question 1
A Bash script pipes a file into a while loop and increments a counter inside the loop. After the loop finishes, echoing the counter prints 0. What is the most likely cause?
- AThe while loop does not support arithmetic expansion because the counter was never declared as an integer type
- BThe piped while loop runs in a subshell, so changes to its variables are not visible to the parent shell
- CVariables cannot be changed inside any loop construct, so the counter must be set in a separate function
- DThe counter was marked as read-only earlier in the script, which blocks every later assignment to it
Show answer and explanationHide answer
Correct answer: BIn Bash, each part of a pipeline, including the while loop here, runs in a subshell, so the parent shell keeps its original value of 0. The other options are wrong because Bash arithmetic works on untyped variables, loops can modify variables, and a read-only variable would produce an error rather than a silent 0.
Question 2
A team writes a reusable Bash function that deletes files from the directory passed as its first argument. A caller once passed an empty value, and the team wants to prevent accidental deletion. Which safeguard fits best?
- AValidate that the argument is non-empty and matches an expected directory before any deletion runs
- BRemove the argument check and rely on each caller to pass a trusted, well-formed value every time
- CStore the target path in a global variable that defaults to the root directory when left unset
- DRun the function with elevated privileges so that permission errors never interrupt the cleanup job
Show answer and explanationHide answer
Correct answer: AChecking inputs inside the function stops an empty or unexpected value from reaching a destructive command. Removing the check, defaulting to the root directory, or raising privileges all increase the risk of deleting the wrong data.
Question 3
An automation job must poll a service's health endpoint until it reports ready, but it should give up after a fixed number of attempts so a broken service does not block the pipeline forever. Which loop design fits this requirement?
- AAn unbounded loop with no retry counter that keeps polling until the job timeout eventually ends the failed poll
- BA loop that runs exactly once and records the first response, regardless of its status
- CA bounded loop with a retry counter that exits early as soon as the endpoint reports ready
- DA recursive call to the same polling function that has no base case and no attempt limit
Show answer and explanationHide answer
Correct answer: CA bounded loop combines an upper limit on attempts with an early exit on success, which meets both requirements. An unbounded loop or recursion without a base case can hang the pipeline, and a single attempt never waits for readiness.
Question 4
A developer's feature branch is behind main, and the developer wants the latest main commits included without rewriting the feature branch's existing history. Which action fits best?
- AMerge main into the feature branch so the new commits arrive through a merge commit
- BReset the feature branch hard to main so its local commits are discarded and it matches main exactly
- CForce-push main over the feature branch on the remote so that both names point at the same commit
- DDelete the feature branch, recreate it from main, and copy the old files back in by hand
Show answer and explanationHide answer
Correct answer: AMerging main into the feature branch keeps the existing commits and adds a merge commit, so no history is rewritten. A hard reset discards the branch's work, force-pushing main over the feature branch destroys remote history, and recreating the branch by hand loses its commit history.
Question 5
What is the main purpose of creating a separate Git feature branch for an automation change before it is reviewed?
- AIt keeps work in progress isolated so the main branch stays stable until the change is reviewed and tested
- BIt stores encrypted credentials that the pipeline reads at build time without exposing them on the main branch
- CIt keeps a permanent copy of the release tag so that older versions can be redeployed without rebuilding them
- DIt grants the change author write access to production hosts that are unavailable from the main branch
Show answer and explanationHide answer
Correct answer: DA feature branch isolates in-progress work so the shared main branch remains deployable until the change passes review. Branches do not store secrets or grant host access, and release tags, not feature branches, are what identify a version for redeployment.
Question 6
A configuration task creates a service account. On its first run it creates the account, and on a second run it reports no change because the account already exists with the same settings. Which property does this describe?
- AImmutability, where a resource is replaced by a new one instead of being changed in place
- BVersioning, where every run is recorded as a new revision of the configuration in source control
- CConcurrency safety, where several automation tasks can run at the same time without conflicting over shared state
- DIdempotency, where repeated runs of the same task converge on the same state without making extra changes
Show answer and explanationHide answer
Correct answer: DIdempotency means running the same desired-state task again leaves the system unchanged once the target state is reached. Immutability describes replacing rather than modifying resources, while concurrency safety and versioning describe different concerns.
Question 7
A platform team stops patching running application servers. Each release now builds a new machine image, launches replacement servers from it, and retires the old ones. Which infrastructure principle does this follow?
- AImmutable infrastructure, where changes are made by replacing servers rather than editing them
- BMutable infrastructure, where servers are updated in place and kept running for their whole lifetime
- CDrift detection, where live servers are compared with the desired state and any differences are reported
- DCanary deployment, where a small share of traffic is sent to the new version before a full rollout begins
Show answer and explanationHide answer
Correct answer: AImmutable infrastructure replaces servers from a known image rather than changing them after launch, which reduces configuration drift. Mutable infrastructure is the approach the team stopped using, while drift detection and canary deployment solve different problems.
Question 8
After a merge, a pipeline fails with a YAML parse error that points to line 42 of a workflow file. Which first step is most appropriate?
- AIncrease the pipeline timeout so that the parser has more time to read the file before it reports a failure
- BOpen the merged file, check for leftover conflict markers and bad indentation near line 42, then lint it
- CRewrite the entire workflow from memory in one commit so that no merge artifacts can remain anywhere in the history
- DRemove the workflow file from the repository and deploy the previous build by hand from a developer laptop
Show answer and explanationHide answer
Correct answer: BParse errors after a merge are often caused by conflict markers or indentation changed during conflict resolution, so inspecting and linting the file near the reported line is the right first step. A longer timeout does not fix syntax, and rewriting or removing the file skips the diagnosis and risks losing reviewed changes.
System Configuration (8 questions)
Question 9
A compliance scan shows that the SSH daemon setting on a web server differs from the value in the configuration repository. No one has committed a change to the repository. What is this condition called?
- ACanary deviation, where a subset of hosts is running a release that was intentionally held back from the fleet
- BImmutable replacement, where the server was rebuilt from a freshly built image that carries a new configuration
- CConfiguration drift, where the live system has diverged from its declared baseline over time
- DState locking, where a lock file prevents two concurrent runs from modifying the same state at the same time
Show answer and explanationHide answer
Correct answer: CConfiguration drift describes live systems that no longer match the declared desired state, often because of manual or out-of-band changes. The other options describe a rebuild, a release strategy, and a concurrency control, none of which explains a mismatch with the repository.
Question 10
An administrator writes a file that states the final desired condition, such as three web nodes running and port 443 open, and the tool works out which steps are needed. Which model is this?
- ADeclarative, where the desired end state is described and the tool determines the steps to reach it
- BImperative, where the administrator lists each command to run in the exact order it should execute
- CAd hoc, where changes are typed directly on each host at a console and are never recorded in any file or repository
- DEvent-driven, where every configuration change is triggered by a webhook call from another system
Show answer and explanationHide answer
Correct answer: ADeclarative configuration describes what the end state should be and leaves the sequence of actions to the tool, which is what this file does. The imperative model lists commands step by step, while ad hoc console changes and event-driven triggers are not defined by a desired-state file.
Question 11
Which statement correctly describes a pull-based configuration management model?
- AA central server initiates every change, and managed nodes wait idle until it sends them commands
- BEach managed node periodically fetches its desired configuration from a central source
- CThe central controller must open an inbound SSH session to every node before each change can be applied
- DDesired configuration cannot be stored as declarative files because the model only supports ad hoc scripts
Show answer and explanationHide answer
Correct answer: BIn a pull model, nodes check in on a schedule and retrieve their own desired state, so the controller does not need to reach into each node. The other options describe push-based control or wrongly claim that pull-based systems cannot use declarative files.
Question 12
A workflow must read the current status of a deployment resource through its REST API without changing anything on the server. Which HTTP method and CRUD operation fit this need?
- APUT, which maps to the Update operation and replaces the representation of the resource
- BPOST, which maps to the Create operation and adds a new resource on the server
- CGET, which maps to the Read operation and does not modify the resource on the server
- DDELETE, which maps to the Delete operation and removes the resource from the server
Show answer and explanationHide answer
Correct answer: CGET retrieves a representation of a resource and is the usual mapping for the CRUD Read operation. POST, PUT, and DELETE map to Create, Update, and Delete, and each of them changes server state, which this workflow must avoid.
Question 13
An automation job calls an HTTPS API and fails with a certificate verification error, though the same URL loads in a browser. The engineer finds that the server sends only its leaf certificate, not the intermediate certificate. What is the most appropriate fix?
- ARaise the job timeout so that the client has more time to finish the TLS negotiation before it fails
- BDisable certificate verification in the job so that the HTTPS connection completes without raising errors
- CChange the request method from GET to POST, because POST requests are not checked against the certificate
- DConfigure the server to present the complete certificate chain, including the intermediate certificates
Show answer and explanationHide answer
Correct answer: DClients validate a server certificate by building a chain up to a trusted root, so the server must send its intermediate certificates. Disabling verification exposes the job to impersonation, and changing the HTTP method or the timeout has no effect on certificate validation.
Question 14
An automation job calls a deployment API with a valid, unexpired token and a well-formed request, but receives HTTP 403 Forbidden. What is the most likely cause?
- AThe token has expired, so the server could not verify the identity of the caller at all
- BThe request body is missing a required field, so the server cannot parse the request it received
- CThe authenticated identity lacks the permission needed for the requested action on that resource
- DThe API gateway is unreachable from the pipeline network, so the request never arrived at the server
Show answer and explanationHide answer
Correct answer: CA 403 status means the server knows who is calling but refuses the action because that identity is not authorized. An expired token normally produces 401 Unauthorized, a malformed body is a 400-class error, and an unreachable gateway produces a connection failure or timeout rather than an HTTP status.
Question 15
Which two practices help detect or reduce configuration drift? (Choose two.)
- ARunning the configuration tool on a schedule to reconcile live systems with the desired state
- BAllowing administrators to make undocumented hotfixes directly on production servers when needed
- CKeeping configuration definitions in version control and comparing them with the running systems
- DRebuilding each server by hand from a wiki page whenever a team member has spare time available
Show answer and explanationHide answer
Correct answer: A, CScheduled reconciliation and version-controlled definitions both expose and correct differences between the declared and live state. Undocumented hotfixes and manual rebuilds from notes are common sources of drift rather than ways to prevent it.
Question 16
An automation client must change only the description field of an existing host record and leave every other field untouched. Which HTTP method is the best fit?
- APUT, which sends the complete resource so that the server replaces every field with the new values
- BPOST, which creates a new host record that holds the changed description and the old field values
- CPATCH, which applies a partial update to only the fields that are included in the request body
- DDELETE followed by GET, which removes the record and then reads back the description field
Show answer and explanationHide answer
Correct answer: CPATCH sends only the changes and leaves other fields as they are, which matches a partial update. PUT replaces the whole resource, POST creates a new one, and deleting then reading removes the record instead of editing it.
Continuous Integration (7 questions)
Question 17
A pipeline builds an application and publishes the result for later deployment stages. Which property makes the published output suitable for storage in an artifact repository?
- AIt is a copy of the production database that is refreshed each time a new build of the application starts
- BIt is a mutable folder of source files that each deployment stage edits in place before it ships
- CIt is a list of unit test results that is overwritten by every new commit pushed to the shared branch
- DIt is a versioned, immutable build output such as a package or image that deployments reuse
Show answer and explanationHide answer
Correct answer: DAn artifact repository stores versioned build outputs so that the same tested package or image can be promoted through environments without being rebuilt. Editable source folders, overwritten test results, and database copies are not artifacts that deployments are meant to reuse.
Question 18
A deployment stage fails its health checks shortly after release. The team wants the system to return automatically to the last known-good version. Which capability does this most directly require?
- AA manual edit of the production database schema so that it matches the code that is currently failing
- BA fresh rebuild of the application from the latest commit on the main branch, which includes the newest fixes
- CRetained earlier artifact versions and a deployment step that redeploys the previous known-good one
- DDeletion of the failed release from the server so that no further traffic can reach the faulty version
Show answer and explanationHide answer
Correct answer: CRollback depends on keeping earlier artifacts and having a repeatable step that redeploys one of them. A rebuild from the latest commit may carry the same fault, schema edits do not restore the old version, and deleting a release without redeploying leaves the service without a working version.
Question 19
In a GitHub Actions workflow file, which top-level element defines the events that start the workflow?
- AThe jobs key, which groups the work that the workflow runs as one or more separate job units
- BThe runs-on key, which selects the operating system or type of runner that executes each job
- CThe steps key, which lists the individual commands and reusable actions executed in sequence inside a job
- DThe on key, which lists the repository events such as push or pull request that trigger the workflow
Show answer and explanationHide answer
Correct answer: DThe on key declares the triggering events for a workflow. The jobs, runs-on, and steps keys define what runs, where it runs, and the commands inside a job, so each of them answers a different question from the one asked.
Question 20
A team wants its Jenkins pipeline stages stored in version control alongside the application code so that changes to the pipeline are reviewed like any other change. Which file is used for this?
- AA Dockerfile that lists each build stage as an image layer
- BA Jenkinsfile committed to the root of the repository
- CA Makefile that contains the login credentials for the CI server
- DA settings.gradle file that defines which agents the CI server may use
Show answer and explanationHide answer
Correct answer: BA Jenkinsfile holds the pipeline definition as code, so it can be versioned, reviewed, and branched with the application. A Dockerfile builds container images, a Makefile is a build tool file that should not hold credentials, and settings.gradle configures Gradle builds rather than Jenkins agents.
Question 21
A developer pushes a commit to the shared repository, and the push succeeds, but no pipeline run starts on the CI server. Which check is most useful first?
- ADelete the local clone, clone the repository again, and then attempt the same push a second time from scratch
- BAdd more unit tests to the suite so that the pipeline has enough work to justify starting a new run
- CConfirm that the webhook delivery from the repository to the CI server succeeded for that push event
- DAsk the developer to force-push the same commit so that the server treats it as new work to build
Show answer and explanationHide answer
Correct answer: CWhen a push succeeds but no build starts, the event delivery from the repository host to the CI server is the first thing to verify. Adding tests, re-cloning locally, and force-pushing do not address whether the trigger reached the CI server.
Question 22
A team wants every change merged to the shared branch to trigger an automated build and test run, so that integration problems are found within minutes. Which practice describes this?
- AContinuous deployment, where every passing change is released to production automatically
- BContinuous integration, where frequent merges trigger automated builds and tests
- CInfrastructure as code, where servers and networks are defined in versioned configuration files
- DConfiguration drift detection, where live systems are compared with the declared baseline on a schedule
Show answer and explanationHide answer
Correct answer: BContinuous integration focuses on merging changes frequently and validating each one with automated builds and tests. Continuous deployment goes further by releasing each change to production, while infrastructure as code and drift detection address different concerns.
Question 23
Which two controls help keep secrets out of CI logs and source repositories? (Choose two.)
- AMasking secret values in build output so that they are not printed in plain text
- BPrinting all environment variables at the start of each job to help debug path problems
- CInjecting secrets at run time from the pipeline's secret store rather than storing them in code
- DCommitting a copy of the production environment file so that every runner receives identical settings
Show answer and explanationHide answer
Correct answer: A, CMasking hides secret values in logs, and run-time injection from a secret store keeps the values out of code and repositories. Printing environment variables exposes secrets in logs, and committing environment files stores real values in the repository where they can leak.
Continuous Delivery (7 questions)
Question 24
A team releases a new version to a small share of users first, watches error rates and latency, and only then sends more traffic to it. Which deployment strategy is this?
- ACanary release, where a small portion of traffic reaches the new version before a wider rollout
- BBlue-green deployment, where the full new environment is switched in at a single cutover point
- CRolling deployment, where instances are replaced in batches until every instance runs the new version
- DRecreate deployment, where all old instances are stopped before any new instances are started
Show answer and explanationHide answer
Correct answer: AA canary release exposes a limited group of users to the new version so that problems appear early with limited impact. Blue-green switches all traffic at a cutover, rolling replaces instances in batches, and recreate stops everything before starting the new version.
Question 25
What is the main advantage of blue-green deployment when a release must be reverted quickly?
- ATraffic can be switched back to the idle environment, which still runs the old version, almost instantly
- BIt needs no extra infrastructure because only one production environment is ever kept running at a time
- CEach instance is updated individually, so the total serving capacity never drops during the release window
- DOnly a fixed percentage of requests reach the new version, which limits the impact of a faulty build
Show answer and explanationHide answer
Correct answer: ABlue-green keeps the previous environment intact, so a rollback is a traffic switch rather than a rebuild. Blue-green does need a second environment, individual instance updates describe rolling deployments, and fixed-percentage routing describes canary releases.
Question 26
An operations team must update a fleet of instances without taking the service fully offline, and it cannot afford to run a second full environment alongside production. Which strategy fits best?
- ABlue-green deployment, which requires a second full environment kept at equal capacity alongside production
- BRolling deployment, which replaces instances in batches so that part of the fleet keeps serving traffic
- CRecreate deployment, which stops every instance first and then starts the new version on all of them
- DFeature flag toggling, which hides the new code path from users without changing any running instance
Show answer and explanationHide answer
Correct answer: BA rolling deployment updates instances in batches, so capacity stays available during the change and no second full environment is needed. Blue-green requires duplicate capacity, recreate causes downtime, and a feature flag does not replace the running instances.
Question 27
An automation pipeline calls a cloud API with a long-lived administrator access key stored in its variables. Which change best follows least-privilege and IAM practice?
- AGrant the pipeline account full owner rights so that no permission errors interrupt a release in progress
- BShare one administrator access key across all pipelines so that rotating it is only needed in a single place
- CStore the key in the SDK source file so that it is versioned with the code and never lost during changes
- DReplace the key with a short-lived role or workload identity limited to the permissions the deployment needs
Show answer and explanationHide answer
Correct answer: DLeast privilege limits what a pipeline can do if its credentials leak, and short-lived workload identities avoid long-lived secrets. Shared administrator keys, keys committed in code, and owner-level grants all widen the impact of a compromise.
Question 28
Which two statements about SLOs, SLAs, and MTTR are correct? (Choose two.)
- AAn SLA is usually an external commitment to customers, and missing it can trigger credits or penalties
- BAn SLO is a contractual promise made to customers and enforced through the terms of a legal agreement
- CMTTR measures the average time needed to restore service after a failure has occurred in a system
- DMTTR is expressed as a percentage that a service must stay above in every calendar month it runs
Show answer and explanationHide answer
Correct answer: A, CAn SLA is the customer-facing agreement, often with stated remedies, and MTTR is an average restoration time. An SLO is an internal reliability target rather than a contract, and MTTR is measured in time, not as a percentage.
Question 29
A service's reliability target for the month has been used up, so its error budget is exhausted. Which response is most consistent with common SRE practice?
- ALower the reliability target so that the exhausted budget is restored immediately and releases can continue
- BKeep the release schedule unchanged, since an error budget only measures the cost of cloud infrastructure
- CSlow risky releases and direct the team toward reliability work until the service is back within its target
- DRemove the monitoring for the service, because the budget can only be used once the alerts are silenced
Show answer and explanationHide answer
Correct answer: CAn error budget is the unreliability the SLO allows, and when it is spent, common practice is to pause risky changes and prioritize stability. Lowering the target to refill the budget, ignoring it, or disabling monitoring all undermine the reliability goal.
Question 30
A team wants to deploy a large change to production now but make it visible only to internal testers at first. Which practice supports this separation of deployment from release?
- AA separate Git branch for each tester, merged into production one tester at a time by hand
- BFeature flags that keep the new code path disabled for most users until it is switched on
- CTwo full production environments kept identical, with users moved between them manually as needed
- DA nightly script that copies the new build onto production servers at a random time each day
Show answer and explanationHide answer
Correct answer: BFeature flags separate deploying code from enabling a feature, so the change is live in production but hidden from most users until it is turned on. Per-tester branches, duplicate environments, and random nightly copies do not give a controlled release of visibility.