CertArea
All Linux Foundation / CNCF exams

Free CGOA practice test: 30 questions with answers

30 original questions for Certified GitOps Associate, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

CGOA exam guide: topics, cost and format

All 30 CGOA questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Observability and security (4 questions)

  1. Question 1

    A GitOps deployment fails, and the team wants to see whether the agent detected the desired state in Git and what error occurred. Which information should they check?

    1. AThe developer's chat history in the team messaging channel about the failed deployment thread
    2. BThe GitOps agent's status and events for the application, showing sync state and errors
    3. CThe developer laptop's battery level and Wi-Fi signal strength during setup
    4. DThe repository's license file and its contributor code of conduct policy
    Show answer and explanation
    Correct answer: B

    The agent's sync status and events show detection and errors. Chat history, battery and licences do not explain sync failures.

  2. Question 2

    A team wants alerts when a GitOps sync fails. Which approach provides this?

    1. AExport controller metrics or events to the monitoring system and alert on failed sync status
    2. BDisable notifications and sync status reporting for the application to avoid noise
    3. CCheck the controller logs once a month during a scheduled manual review meeting
    4. DAsk developers to report failed syncs through a shared chat channel if noticed
    Show answer and explanation
    Correct answer: A

    Exporting metrics or events and alerting on failures provides timely notification. Monthly checks, disabled notifications and developer reports are unreliable.

  3. Question 3

    A security team wants to ensure that only signed commits are deployed from the repository. Which practice supports this?

    1. AAccept commits from every contributor regardless of author identity, since review gates merges
    2. BRequire signed commits and verify signatures in the deployment pipeline or controller
    3. CIgnore signatures because they slow down merges in the release pipeline
    4. DSign commits with a shared team key stored in the CI runner environment
    Show answer and explanation
    Correct answer: B

    Signed commits and verification ensure authorship and integrity. Accepting any commit, ignoring signatures and shared keys weaken assurance.

  4. Question 4

    A GitOps controller is granted cluster-wide admin rights for convenience. What is the security concern?

    1. AAdmin rights remove the need for review of changes made to the cluster through pull requests
    2. BNo concern exists for the cluster, because the controller reads manifests from Git and runs inside the trusted zone
    3. CExcessive privileges increase the impact if the controller or its credentials are compromised
    4. DAdmin rights make the controller faster when reconciling large fleets of manifests across clusters
    Show answer and explanation
    Correct answer: C

    Excessive privileges widen the blast radius of compromise. Speed, review removal and no concern are incorrect.

Declarative configuration (4 questions)

  1. Question 5

    A team wants to reuse a Kubernetes application configuration across development and production with small differences per environment. Which tool supports this with overlays?

    1. AKustomize
    2. BGit LFS
    3. CRsync only
    4. DCron
    Show answer and explanation
    Correct answer: A

    Kustomize uses bases and overlays to customize configuration per environment. Git LFS stores large files, rsync copies files, and cron schedules jobs.

  2. Question 6

    A team packages a complex application with templates, values files, and versioned releases for installation in clusters. Which tool is designed for this?

    1. AGit LFS
    2. BHelm
    3. Cgrep
    4. DPing
    Show answer and explanation
    Correct answer: B

    Helm packages applications as charts with templates and values and manages releases. Ping tests reachability, grep searches text, and Git LFS stores large files.

  3. Question 7

    A manifest must hold a secret value for a deployment. What is the recommended approach in a GitOps repository?

    1. AStore the secret encrypted with a tool such as Sealed Secrets or SOPS, or reference an external secret manager
    2. BStore the plain-text secret directly in the Deployment manifest's env block, base64-encoded so it is version-controlled in Git history
    3. CShare the secret in the team chat channel so that teammates can copy the value into their local environment files for testing
    4. DCommit the secret in a YAML comment above the Secret resource so reviewers can see which value to use during each production rollout
    Show answer and explanation
    Correct answer: A

    Encrypted secrets or external references keep secrets out of plain-text Git history. Plain-text values, comments and chats expose secrets.

  4. Question 8

    A team wants to ensure that a Kubernetes manifest follows organization policy before it is merged. Which practice supports this?

    1. AReviewing the manifest manually after deployment through a periodic audit of the running cluster
    2. BLetting each engineer decide their own policy for naming, resource limits and image sources in each team
    3. CSkipping validation to speed up merges while the review queue is growing
    4. DPolicy checks in the pull request pipeline that validate manifests against defined rules
    Show answer and explanation
    Correct answer: D

    Policy checks in the PR pipeline catch violations before merge. Post-deployment review, skipping validation and individual policies do not enforce consistency.

GitOps fundamentals (4 questions)

  1. Question 9

    In GitOps, what is the single source of truth for the desired state of a system?

    1. AA shared spreadsheet listing server hostnames and their owners
    2. BA version-controlled Git repository containing declarative configuration
    3. CThe live cluster's current runtime state, as reported by kubelets
    4. DThe CI server's build logs and test output from each pipeline stage
    Show answer and explanation
    Correct answer: B

    GitOps uses a Git repository of declarative configuration as the source of truth. The live state is what the system reconciles toward, spreadsheets and logs are not the source of truth.

  2. Question 10

    A GitOps agent continuously compares the cluster with the Git repository and corrects differences. What is this process called?

    1. ABootstrapping only
    2. BCaching
    3. CReconciliation
    4. DCompilation
    Show answer and explanation
    Correct answer: C

    Reconciliation continuously aligns the live state with the desired state in Git. Compilation builds code, bootstrapping is initial setup, and caching stores data.

  3. Question 11

    Which principle describes GitOps desired state being described declaratively rather than as a sequence of imperative commands?

    1. ADeclarative configuration describing the desired end state
    2. BRandom changes tested directly in production clusters
    3. CImperative shell scripts that run each command in order
    4. DManual point-and-click edits made in the web console
    Show answer and explanation
    Correct answer: A

    Declarative configuration describes the end state, which controllers reconcile. Imperative scripts and manual changes are not the GitOps model.

  4. Question 12

    A team wants every change to the production cluster to be reviewed and traceable. Which GitOps practice provides this?

    1. AChanges are proposed and agreed informally in team chat messages before rollout
    2. BChanges are copied from a personal laptop's local working directory and pushed to the cluster by hand
    3. CChanges flow through pull requests that are reviewed and merged before the agent applies them
    4. DEngineers apply changes directly with kubectl against the production cluster to hotfix running workloads quickly
    Show answer and explanation
    Correct answer: C

    Pull requests with review and merge provide review and traceability before reconciliation. Direct kubectl edits, chat changes and laptop copies bypass that control.

Git fundamentals (4 questions)

  1. Question 13

    A developer wants to create an isolated branch to work on a feature without affecting the main branch. Which command does this?

    1. Agit reset --hard origin/main
    2. Bgit tag -a v1.4.0-feature -m 'feature'
    3. Cgit push --force origin HEAD:main
    4. Dgit switch -c feature/new-config
    Show answer and explanation
    Correct answer: D

    git switch -c creates and switches to a new branch. Force-pushing main, hard resets and tagging do not create an isolated feature branch.

  2. Question 14

    A repository's main branch must not receive direct commits, and changes must go through review. Which practice enforces this on the hosting platform?

    1. AA README policy describing the expected review steps
    2. BDisabling pull request creation for the main branch
    3. CBranch protection rules requiring pull requests and approvals
    4. DAsking developers and reviewers not to commit directly
    Show answer and explanation
    Correct answer: C

    Branch protection enforces review and prevents direct pushes. Requests, README policies and disabling PRs do not enforce the control.

  3. Question 15

    Two developers changed the same line of a configuration file on different branches. When merging, Git reports a conflict. What does this mean?

    1. AThe repository is corrupted, so its object database must be rebuilt
    2. BThe feature branch was deleted on the remote before the merge started
    3. CThe merge has succeeded with both changes applied automatically by Git
    4. DGit cannot automatically decide which change to keep, so a person must resolve it
    Show answer and explanation
    Correct answer: D

    Conflicting changes to the same lines require manual resolution. Corruption, automatic success and deletion are not implied by a conflict.

  4. Question 16

    A team wants to undo a faulty commit that has already been pushed to a shared branch, without rewriting shared history. Which command is appropriate?

    1. ADeleting the repository and recreating it from a fresh clone
    2. Bgit reset --hard HEAD~1 on the shared main branch
    3. Cgit push --force to rewrite the faulty commit out of history
    4. Dgit revert followed by a new commit that undoes the change
    Show answer and explanation
    Correct answer: D

    git revert creates a new commit that reverses the change and is safe for shared branches. Force pushes and hard resets rewrite shared history, and deleting repositories is destructive.

CI and CD integration (4 questions)

  1. Question 17

    A CI pipeline builds a container image. The GitOps repository must be updated with the new image tag. Which approach follows GitOps principles?

    1. AThe developer edits the cluster manually after the build, using kubectl edit on each Deployment
    2. BThe pipeline opens a pull request updating the image tag in the GitOps repository
    3. CThe pipeline records the new tag in a build log file for auditing
    4. DThe pipeline deploys directly to production with kubectl apply against the live API server
    Show answer and explanation
    Correct answer: B

    Updating the repository through a pull request keeps Git as the source of truth. Direct deployment, logs and manual edits bypass GitOps control.

  2. Question 18

    A CI system must not have permission to modify production clusters, but it must produce artifacts for deployment. Which separation supports this?

    1. ACI has full cluster administrator access, bound to a cluster-admin ClusterRoleBinding that covers every namespace in the fleet
    2. BCI deploys to production using a shared root key stored as a long-lived repository secret in shared CI variables
    3. CCI builds and publishes artifacts, while the GitOps agent in the cluster pulls and applies configuration
    4. DCI deploys to production by emailing rendered manifests to the ops lead for manual apply
    Show answer and explanation
    Correct answer: C

    Separating CI from cluster changes with a pull-based agent reduces privilege. Admin access, shared root keys and email deployments are unsafe.

  3. Question 19

    A team wants to use pull-based GitOps rather than push-based deployment. What is the key difference?

    1. AIn pull-based GitOps, an agent inside the cluster fetches desired state from Git, reducing external credentials
    2. BPull-based deployment does not update the cluster until an operator manually triggers a sync from the Git server so drift builds up
    3. CPull-based deployment requires the Git server to hold cluster admin credentials and a kubeconfig with cluster-admin role bindings
    4. DPush-based deployment is generally more secure because CI keeps credentials out of the cluster's network perimeter
    Show answer and explanation
    Correct answer: A

    Pull-based agents fetch from Git and avoid storing cluster credentials externally. The other statements misstate the model.

  4. Question 20

    Which THREE steps are commonly part of a GitOps delivery flow? (Choose three.)

    1. AChange proposed through a pull request
    2. BEngineers edit the live cluster directly to speed up delivery
    3. CChanges are deployed based on chat approvals only
    4. DAutomated checks run on the proposed change
    5. EThe GitOps agent reconciles the cluster after merge
    Show answer and explanation
    Correct answer: A, D, E

    Pull requests, automated checks and agent reconciliation form a GitOps flow. Direct live edits and chat-only approvals bypass the flow.

Kubernetes basics for GitOps (4 questions)

  1. Question 21

    A Deployment in Kubernetes must keep a specified number of identical pods running. Which property sets this?

    1. Aspec.replicas
    2. Bspec.hostNetwork
    3. Cstatus.phase
    4. Dmetadata.name
    Show answer and explanation
    Correct answer: A

    spec.replicas defines the desired number of pod replicas. The name is an identifier, hostNetwork controls networking, and status.phase reports observed state.

  2. Question 22

    A team wants to expose an HTTP service to clients outside the cluster through a host name and path rules. Which resource is used?

    1. ASecret
    2. BConfigMap
    3. CPersistentVolumeClaim
    4. DIngress
    Show answer and explanation
    Correct answer: D

    Ingress routes external HTTP traffic to services by host and path. ConfigMaps and Secrets store data, and PVCs request storage.

  3. Question 23

    A workload needs non-sensitive configuration values injected into its containers. Which resource stores them?

    1. AConfigMap
    2. BRole
    3. CNamespace
    4. DSecret for all values including non-sensitive ones
    Show answer and explanation
    Correct answer: A

    ConfigMaps hold non-sensitive configuration. Secrets are for sensitive data, namespaces partition resources, and roles grant permissions.

  4. Question 24

    A namespace must have a limit on total CPU and memory that its workloads can request. Which object enforces this?

    1. AResourceQuota
    2. Bbatch/v1 CronJob
    3. Ccore/v1 Service
    4. Dv1 Ingress
    Show answer and explanation
    Correct answer: A

    ResourceQuota limits aggregate resource use in a namespace. Ingress routes traffic, Services expose pods, and CronJobs schedule jobs.

GitOps tooling (3 questions)

  1. Question 25

    An organization uses a GitOps controller that supports multiple repositories and Helm and Kustomize sources. Which capability describes this flexibility?

    1. ANo native support for Helm charts or values files in the application spec
    2. BA requirement that every source use plain YAML manifests, not templates
    3. CSupport for multiple source types within a single application or project definition
    4. DA restriction to one Git repository per cluster, with no secondary repos
    Show answer and explanation
    Correct answer: C

    Modern GitOps controllers support multiple source types through application or project definitions. Plain-YAML-only, single-repo restrictions and no Helm support are not accurate.

  2. Question 26

    A GitOps tool offers a sync policy that automatically corrects drift. An operator wants to prevent automatic changes for a sensitive workload. Which setting should be used?

    1. AManual sync policy for that application so changes are applied after approval
    2. BDisabling the repository, which stops polling and leaves drift unchecked for each application
    3. CAutomatic pruning enabled for every resource, including Secrets and PVCs
    4. DDeleting the Application object from the Argo CD namespace and its history
    Show answer and explanation
    Correct answer: A

    A manual sync policy requires approval before changes apply to sensitive workloads. Automatic pruning, disabling repositories and deleting applications create other risks.

  3. Question 27

    A GitOps controller is configured with automated pruning. A file is removed from the repository. What is the expected effect?

    1. ANothing happens because pruning is disabled by default in the sync policy of the application
    2. BThe corresponding resource is deleted from the cluster during reconciliation
    3. CThe entire cluster is deleted along with its namespaces, CRDs and the GitOps controller
    4. DThe file is restored automatically from the last known good revision of the repository
    Show answer and explanation
    Correct answer: B

    Automated pruning removes resources no longer present in Git during reconciliation. Pruning is not disabled by default in all tools, it does not delete the whole cluster, and it does not restore the file.

Kustomize and Helm (3 questions)

  1. Question 28

    A Kustomize overlay for production patches the replica count of a base Deployment. What should the overlay contain?

    1. AA copy of the entire base manifest with no reference, duplicated per environment
    2. BA shell script that edits the YAML by hand, with text substitutions run before kubectl apply
    3. CA Helm release name given at helm install time, which Helm uses to track chart revisions and rollback history
    4. DA kustomization file that references the base and applies a patch to the replicas field
    Show answer and explanation
    Correct answer: D

    An overlay references the base and applies targeted patches. Copying everything duplicates config, manual scripts are fragile, and Helm release names are not Kustomize patches.

  2. Question 29

    A Helm chart is installed with a values file that sets the image tag for production. What do the values control?

    1. AThe cluster's hardware, including node CPU count and disk type
    2. BParameters that render the chart's templates into manifests
    3. CThe Git branch name that the GitOps controller tracks for each sync
    4. DThe developer's editor theme, font size, and keybindings in the IDE
    Show answer and explanation
    Correct answer: B

    Values feed the chart's templates to produce manifests. Branch names, hardware and editor themes are not controlled by values.

  3. Question 30

    A team wants to see the final manifests that a Helm chart would produce without installing it. Which command helps?

    1. Ahelm repo remove
    2. Bhelm uninstall
    3. Chelm rollback
    4. Dhelm template
    Show answer and explanation
    Correct answer: D

    helm template renders manifests locally without installing. Uninstall, rollback and repo removal change releases or repositories.