Linux Foundation / CNCF CGOA: Certified GitOps Associate

Last checked October 22, 2026 against the official Linux Foundation / CNCF exam page.

1. Question 1Observability and security

   A GitOps deployment fails, and the team wants to see whether the agent detected the desired state in Git and what error occurred. Which information should they check?

   1. AThe developer's chat history in the team messaging channel about the failed deployment thread
   2. BThe GitOps agent's status and events for the application, showing sync state and errors
   3. CThe developer laptop's battery level and Wi-Fi signal strength during setup
   4. DThe repository's license file and its contributor code of conduct policy
   Show answer and explanationHide answer

   Correct answer: B

   The agent's sync status and events show detection and errors. Chat history, battery and licences do not explain sync failures.

2. Question 2Declarative configuration

   A team wants to reuse a Kubernetes application configuration across development and production with small differences per environment. Which tool supports this with overlays?

   1. AKustomize
   2. BGit LFS
   3. CRsync only
   4. DCron
   Show answer and explanationHide answer

   Correct answer: A

   Kustomize uses bases and overlays to customize configuration per environment. Git LFS stores large files, rsync copies files, and cron schedules jobs.

3. Question 3GitOps fundamentals

   In GitOps, what is the single source of truth for the desired state of a system?

   1. AA shared spreadsheet listing server hostnames and their owners
   2. BA version-controlled Git repository containing declarative configuration
   3. CThe live cluster's current runtime state, as reported by kubelets
   4. DThe CI server's build logs and test output from each pipeline stage
   Show answer and explanationHide answer

   Correct answer: B

   GitOps uses a Git repository of declarative configuration as the source of truth. The live state is what the system reconciles toward, spreadsheets and logs are not the source of truth.

4. Question 4Git fundamentals

   A developer wants to create an isolated branch to work on a feature without affecting the main branch. Which command does this?

   1. Agit reset --hard origin/main
   2. Bgit tag -a v1.4.0-feature -m 'feature'
   3. Cgit push --force origin HEAD:main
   4. Dgit switch -c feature/new-config
   Show answer and explanationHide answer

   Correct answer: D

   git switch -c creates and switches to a new branch. Force-pushing main, hard resets and tagging do not create an isolated feature branch.

5. Question 5CI and CD integration

   A CI pipeline builds a container image. The GitOps repository must be updated with the new image tag. Which approach follows GitOps principles?

   1. AThe developer edits the cluster manually after the build, using kubectl edit on each Deployment
   2. BThe pipeline opens a pull request updating the image tag in the GitOps repository
   3. CThe pipeline records the new tag in a build log file for auditing
   4. DThe pipeline deploys directly to production with kubectl apply against the live API server
   Show answer and explanationHide answer

   Correct answer: B

   Updating the repository through a pull request keeps Git as the source of truth. Direct deployment, logs and manual edits bypass GitOps control.