Certified GitOps Associate (CGOA) Practice Exam

What the Certified GitOps Associate (CGOA) exam covers

• GitOps Terminology148 questions
• GitOps Principles193 questions
• Related Practices104 questions
• GitOps Patterns148 questions
• Tooling148 questions

Free Certified GitOps Associate (CGOA) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 741.

1. Question 1GitOps Patterns

   A platform team keeps GitOps manifests for 40 microservices in one repository, one folder per service. What is the main drawback of this monorepo layout versus polyrepo?

   • AA single bad commit or broad permission can affect every service at once.Correct
   • BThe agent can no longer reconcile declaratively and must use kubectl apply manually.
   • CEvery service must share the same base image and language runtime.
   • DThe agent can only watch a single directory per cluster.
   ✓ Correct answer: A

   One leaked credential, misconfigured webhook, or careless commit to a shared path can ripple across every service the repo holds. Polyrepo layouts naturally contain that blast radius to a single service.

   Why the other options are wrong

   • BRepo layout does not affect whether reconciliation is declarative; that depends on the agent and manifests, not the number of repos.
   • CBuild tooling and base images are an application concern, unrelated to how manifests are grouped in Git.
   • DGitOps agents like Argo CD or Flux can watch and sync many paths or Applications from one repository.
2. Question 2GitOps Patterns

   In a pull-based GitOps deployment model, which component is responsible for detecting changes in Git and applying them to the cluster?

   • AAn in-cluster agent that continuously watches the Git repositoryCorrect
   • BA CI pipeline stage that runs kubectl apply against the cluster
   • CA webhook receiver on the Git server that pushes manifests out
   • DA human operator who runs helm upgrade after each merge
   ✓ Correct answer: A

   Pull-based GitOps relies on an agent or controller running inside the target cluster that periodically fetches the desired state from Git and reconciles the live cluster to match it, with no external system needing to push into the cluster.

   Why the other options are wrong

   • BA pipeline running kubectl apply describes the push model, where the pipeline (not an in-cluster agent) performs the apply.
   • CA webhook triggering an outbound push from Git is still push-oriented, not an agent pulling.
   • DManual application by an operator is imperative ops, not an automated GitOps pattern.
3. Question 3GitOps Principles

   According to the OpenGitOps Declarative principle, how must the desired state of a system managed by GitOps be expressed?

   • AAs a declarative description of the desired end stateCorrect
   • BAs a sequential script of imperative commands
   • CAs a set of manually run checklist steps
   • DAs verbal handoff notes between engineers
   ✓ Correct answer: A

   The OpenGitOps Declarative principle states that a system managed by GitOps must have its desired state expressed declaratively, as data describing what the end state should look like. This is distinct from imperative approaches that describe a sequence of actions to perform.

   Why the other options are wrong

   • BA sequence of commands describes 'how' to change a system, which is imperative, not declarative.
   • CA manual checklist depends on human execution order and is not a machine-readable, declarative artifact.
   • DVerbal instructions are not stored, reviewable, or machine-actionable, so they cannot serve as a declarative desired state.
4. Question 4GitOps Principles

   Does OpenGitOps require that GitOps-managed systems run on Kubernetes specifically?

   • ANo, the principles are written to be broadly applicable beyond any single orchestration platformCorrect
   • BYes, Kubernetes is explicitly named as a mandatory requirement in the principles
   • CYes, but only for systems larger than a certain defined size
   • DNo, but only non-containerized systems may use the principles
   ✓ Correct answer: A

   While Argo CD, Flux, and most popular GitOps tooling are commonly used with Kubernetes, the OpenGitOps principles themselves describe general properties of desired state management and reconciliation that are not textually restricted to any one platform.

   Why the other options are wrong

   • BThe principles do not name Kubernetes as a mandatory requirement; they are written more generally.
   • CThere is no system-size threshold in the principles' definition.
   • DThe principles are not restricted to non-containerized systems; they are meant to be broadly applicable.
5. Question 5GitOps Principles

   Which statement corrects the misconception that 'GitOps just means deploying on every commit'?

   • AGitOps only applies changes when a new commit is pushed
   • BGitOps requires a commit for every reconciliation pass
   • CReconciliation also corrects drift that occurs between commitsCorrect
   • DGitOps disables reconciliation between releases
   ✓ Correct answer: C

   GitOps is not limited to deploying whenever a commit is pushed; the continuous reconciliation loop also keeps checking and correcting drift that appears between commits, independent of any new source change.

   Why the other options are wrong

   • AThis restates the misconception rather than correcting it.
   • BReconciliation happens independent of new commits, so it does not require one for every pass.
   • DReconciliation continues to run between releases rather than being disabled.
6. Question 6Related Practices

   What benefit does IaC provide that GitOps then extends with automation?

   • ARepeatable, version-controlled definitions that can be reviewedCorrect
   • BAutomatic drift correction with no code being written
   • CEncryption of all data at rest by default
   • DReal-time application performance monitoring
   ✓ Correct answer: A

   IaC's core value is that infrastructure definitions are repeatable, stored in version control, and can be reviewed and reused. GitOps extends this foundation by adding automated, continuous enforcement of that code.

   Why the other options are wrong

   • BAutomatic drift correction is the GitOps-added capability, not something plain IaC provides by itself.
   • CIaC does not automatically encrypt data at rest; that depends on separate configuration and tooling.
   • DPerformance monitoring is an observability concern, not something IaC itself provides.
7. Question 7Related Practices

   Testing, PR review, and merge are described together as a GitOps change-control practice. What does this mean?

   • ATesting and review happen only after going live
   • BThe reconciler itself performs code review before applying
   • CMerge conflicts resolve automatically, no human input
   • DProposed changes are validated and approved before enforcementCorrect
   ✓ Correct answer: D

   It means this combination is the process by which proposed changes are validated through testing and approved through review before they are allowed to become the new desired state that the reconciler enforces.

   Why the other options are wrong

   • ATesting and review are meant to happen before a change is merged and reconciled, not only after it is already live.
   • BCode review is performed by human reviewers during the pull request process, not by the reconciler.
   • CMerge conflict resolution is a separate mechanical concern, not what makes this combination a change-control practice.
8. Question 8GitOps Terminology

   A new engineer is told: "Our Git repository is the single source of truth. It holds the desired state as declarative configuration, and every change is recorded as an immutable commit." Which term in that sentence names the authoritative record that all configuration changes must be checked against?

   • ASingle source of truthCorrect
   • BDeclarative configuration
   • CImmutable commit
   • DDesired state
   ✓ Correct answer: A

   The other terms in the sentence describe the style of the configuration, how each change is recorded, and the content being declared, but the designation of being the one trusted authoritative reference is captured specifically by source of truth.

   Why the other options are wrong

   • BDeclarative configuration refers to the style in which the state is expressed, not to being the authoritative record itself.
   • CImmutable commit refers to how each change is recorded, not to the concept of being the one trusted reference.
   • DDesired state refers to the content that is declared, not to the designation of it being the trusted reference point.
9. Question 9GitOps Terminology

   How do 'idempotence' and 'eventual consistency' relate to each other as reconciliation vocabulary?

   • AThey are simply two different names for the exact same identical property
   • BIdempotence is a per-action property; eventual consistency is a system-wide guaranteeCorrect
   • CIdempotence applies only to Git commits, eventual consistency only to images
   • DEventual consistency means reconciliation never needs to be idempotent
   ✓ Correct answer: B

   The two terms work together but describe different levels: idempotence makes individual repeated actions safe, while eventual consistency describes the resulting system-wide guarantee of eventually reaching alignment.

   Why the other options are wrong

   • AThe two terms describe related but distinct concepts at different levels, so they are not simply identical.
   • CNeither term is restricted specifically to Git commits or container images.
   • DIn practice both properties work together; eventual consistency does not remove the need for idempotent actions within the loop.
10. Question 10ToolingSelect all that apply

    Which TWO of the following are true of BOTH Argo CD and Flux? (Choose TWO)

    • ABoth are CNCF Graduated projectsCorrect
    • BBoth run their reconciling controllers inside the cluster and pull from the configured sourceCorrect
    • CBoth ship an identical built-in web dashboard with the exact same features
    • DBoth require an external CI system to run kubectl apply against the cluster on their behalf
    • EBoth are CNCF Sandbox stage projects
    ✓ Correct answer: A, B

    Both are top-tier CNCF GitOps reconcilers whose controllers run in-cluster and pull from Git or another versioned source, even though their UI and architecture differ.

    Why the other options are wrong

    • COnly Argo CD ships a built-in web dashboard as a core component; Flux does not by default.
    • DNeither tool requires external CI to push changes in, since their in-cluster agents pull instead.
    • EBoth are Graduated, not Sandbox stage.

Who this Certified GitOps Associate (CGOA) practice exam is for

This practice set is for anyone preparing for the Certified GitOps Associate (CGOA) exam at the intermediate level - from first-time candidates building a foundation to experienced Cloud Native practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Certified GitOps Associate (CGOA) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Certified GitOps Associate (CGOA) exam.

Related Cloud Native resources

• Certified GitOps Associate (CGOA) study guideKey concepts
• Cloud Native practice examsAll Cloud Native
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• KCSA practice examRelated
• CKS practice examRelated
• CKA practice examRelated

Certified GitOps Associate (CGOA) practice exam FAQ