01. Why is the pull model generally considered more secure than a push model in GitOps?
a) It grants the external continuous integration system direct write access to every cluster it deploys to.
b) It removes the need for any credentials because the cluster trusts every change in the store automatically.
c) It stores the cluster credentials in the external pipeline so they can be rotated centrally for every environment.
d) It keeps cluster credentials inside the cluster, so no external system needs write access.
02. During a gradual progressive-delivery rollout, the automated analysis of the new version's health and metrics regresses past the defined thresholds.
What does the progressive-delivery controller do in response?
a) It pauses the rollout and holds indefinitely until an operator manually decides whether to continue or revert.
b) It continues shifting all remaining traffic to the new version, because a gradual rollout always runs to completion once it has started.
c) It automatically halts the rollout and rolls back to the previous version, because a regression in the analysis is itself the signal that triggers that decision.
d) It switches every user onto a second complete standby environment in a single cutover, leaving the regressed version running beside it.
03. Within the Argo project, which component is the GitOps reconciler that continuously syncs declared desired state from the store to the cluster?
a) Argo Workflows, which runs the reconciliation by executing a directed graph of container steps on each change.
b) Argo CD, which pulls the declared desired state and reconciles the cluster to match it.
c) Argo Rollouts, a progressive-delivery controller that shifts traffic toward new versions.
d) Argo Events, which pulls the desired state on a timer, diffs it against the cluster, and reconciles any drift it detects.
04. Which option lists the core responsibilities of a GitOps reconciliation engine in the order it performs them?
a) Template the manifests from values, render the overlays, and hand the result to an operator to apply by hand.
b) Build and test the container image, push it to a registry, then open a pull request against the manifests.
c) Observe the actual cluster state, diff it against the declared desired state, apply changes to correct any difference, and report sync status and health.
d) Apply the desired state once at deploy time, confirm the initial rollout succeeded, log the outcome, and then stop.
05. A team currently deploys with a push-based CD job that runs kubectl apply against the cluster. They adopt GitOps while keeping their existing build-and-test stage.
What specifically changes in the deploy step?
a) An in-cluster agent pulls the desired state from the store and reconciles it, replacing the job that pushed changes to the cluster.
b) Developers apply the manifests to the cluster by hand instead of through a pipeline.
c) The existing push-based job keeps applying changes directly to the cluster, and GitOps only adds a read-only status dashboard on top of it.
d) The build-and-test stage is removed entirely, and the reconciliation agent now compiles the application code itself before deploying it.
06. Some GitOps patterns operate at the store and promotion level, changing the declared desired state, while others operate at the traffic and release level, shifting live traffic between versions.
Which of the following operate at the store and promotion level?
(Choose all that apply)
a) Canary release, routing a small and increasing share of live traffic to the new version, widening from a small cohort to a broader audience to all users as the metrics stay healthy.
b) Environment promotion, advancing the same declared state from dev to stage to production in the store.
c) App-of-apps composition, where a reconciled root declaration manages its child applications.
d) Blue-green release, switching all live traffic between two complete environments at once.
07. What role does a policy engine such as OPA/Gatekeeper or Kyverno play in a GitOps workflow?
a) It builds and tests container images before CI pushes them.
b) It validates or mutates declared resources against policy-as-code at admission, not reconciling state.
c) It replaces the reconciliation engine by pulling desired state from the store and continuously correcting any drift it finds.
d) It packages application manifests into versioned, templated charts so the store can hold an immutable, reproducible release.
08. In a GitOps workflow, what does the state store hold, and where does the container image come from?
a) The store holds nothing durable; the reconciler reads desired state from the live cluster, caches it in memory, and discards it after each sync.
b) The store holds imperative deployment scripts that CI executes directly against the cluster.
c) The store holds the declarative manifests; CI builds the image separately, and the manifests reference it by an immutable digest or tag.
d) The store holds the running container images themselves, which the reconciler rebuilds from source on every sync.
09. How does a GitOps reconciliation engine relate to CI systems, policy engines, and progressive-delivery controllers?
a) It replaces all of them, taking over image builds, admission policy, and traffic shifting as a single combined tool.
b) It operates in isolation and cannot integrate with CI, policy engines, or progressive-delivery controllers at all.
c) It builds and tests the container images itself, which removes the need for a separate CI system.
d) It integrates with each of them, but does not itself build images, enforce admission policy, or shift traffic between versions.
10. GitOps requires that desired state live in a store that is versioned and immutable. Besides a Git repository, which of the following can serve as that store?
a) A shared network folder whose files operators overwrite in place as needed.
b) An OCI registry holding versioned, immutable artifact bundles.
c) A live cluster database the reconciler queries for the current configuration at runtime.
d) Only a Git repository qualifies, because the GitOps principles mandate Git specifically as the version-controlled source of truth.