A deployment notification currently announces success when a configuration commit reaches the repository. Users sometimes receive that notification even though deployment later fails.
For this application, "deployment complete" means that the intended revision has been applied and the resulting workload has passed its configured health checks.
Which TWO conditions should the notification evaluate?
The configuration pull request has all required approvals and its checks have passed.
The source controller has downloaded the commit and made it available to deployment components.
The deployment controller reports successful application of the intended revision.
The workload's configured health or readiness evaluation has completed successfully for that deployment.
C
Successful application of the intended revision and a successful workload health evaluation establish the completion condition defined in the question. Pull request approvals and source retrieval are prerequisites, not proof that deployment completed.
Tooling
25
Select Two
D
An Argo CD application has automated synchronization enabled. The team wants tracked live-state modifications corrected automatically.
However, removing a manifest from Git must not automatically delete the corresponding live resource. Resource deletion will follow a separate approved procedure.
Which additional settings meet these requirements?
Enable automatic pruning and leave self-healing disabled.
Enable self-healing and leave automatic pruning disabled.
Enable self-healing and automatic pruning together.
Leave self-healing and automatic pruning disabled.
B
Self-healing corrects tracked live-state changes, and automatic pruning controls deletion of resources removed from desired state. Enabling pruning gives the unwanted deletion behavior, enabling both does the same, and leaving self-healing disabled leaves live modifications uncorrected.
Tooling
24
Select One
A team maintains plain Kubernetes YAML for a service. Staging and production need different replica counts and labels, but most configuration is shared.
The team wants to reuse the existing manifests and express environment differences as patches without introducing a template language.
Which approach best meets this requirement?
Copy the manifests into environment directories and synchronize common changes with a maintenance script.
Convert the manifests to a Helm chart and represent each environment's differences through values files.
Substitute environment variables into the YAML through CI before committing a generated copy for each environment.
Create a Kustomize base from the manifests and maintain environment-specific overlays.
D
Kustomize bases and overlays support reuse of existing YAML with declarative patches. Copying manifests duplicates configuration and adds synchronization work, a Helm chart introduces templating, and variable substitution adds generated-copy maintenance instead of the requested patch-based structure.
Tooling
23
Select One
A service team must validate a complete new version through an internal preview endpoint before ordinary users receive traffic. At release time, it wants to switch the service endpoint to the new version and retain the old version briefly for rapid recovery.
The platform has capacity for both versions. Their database interactions are backward compatible.
Which deployment pattern best fits these requirements?
Blue-green deployment with separate active and preview routing.
Rolling deployment that replaces instances incrementally behind the existing service.
Canary deployment that evaluates the new version using a small share of ordinary user traffic.
Recreate deployment that stops the previous version before starting its replacement.
A
Blue-green deployment supports a separate preview version followed by an active-service switch. Rolling deployment incrementally replaces instances, canary uses partial ordinary-user exposure, and recreate removes the old version before starting the new one.
GitOps Patterns
22
Select One
An organization manages clusters in several isolated networks. Each cluster can make outbound connections to a shared configuration service, but a central management system cannot reach the clusters' API endpoints.
The organization wants continuous GitOps reconciliation without introducing new inbound network paths.
Which architecture best fits these constraints?
Run one central reconciler and authenticate its calls to each cluster through separate service accounts.
Run central deployment workers and give each worker a cluster-specific configuration repository.
Run a reconciler inside each cluster and let it retrieve its configuration through outbound connections.
Run a central scheduler that sends deployment commands through inbound webhooks exposed by each cluster.
C
An in-cluster reconciler can reach the local API and retrieve configuration through permitted outbound connections. A central reconciler or central workers still require central access to cluster APIs, and exposing inbound webhooks introduces the inbound paths the scenario excludes. The selection follows from the scenario's network constraints; external reconcilers are valid where connectivity permits them.
GitOps Patterns
21
Select One
A GitOps agent polls a repository every few minutes. The team wants faster reactions to commits, but repository webhook delivery is occasionally interrupted.
Which design reduces normal detection latency while retaining recovery from missed notifications?
Apply the webhook's configuration payload directly and use periodic checks to record the resulting live state.
Use webhooks to request an immediate source refresh and retain periodic retrieval and reconciliation.
Replace polling with webhooks and retain failed webhook requests in the repository server's logs.
Let CI deploy after each commit and use the GitOps agent only to report later configuration differences.
B
A webhook can request an earlier refresh while the agent still retrieves desired state, and periodic operation provides a recovery path for missed notifications. Applying the webhook payload changes the workflow to payload-driven application, replacing polling lacks that fallback, and CI-driven deployment separates deployment from corrective reconciliation.
GitOps Patterns
20
Select One
A team wants to introduce a new application version while limiting the number of users exposed to a regression.
Its platform can split traffic between the existing and candidate versions and collect metrics separately for each. The team wants promotion decisions based on observed behavior rather than elapsed time alone.
Which TWO elements belong in the rollout design?
Evaluate the combined error rate across both versions and promote when the overall service remains within its target.
Begin with a limited candidate traffic share and increase exposure after successful evaluation.
Define candidate-specific acceptance criteria and an abort action that returns traffic to the stable version.
Keep a fixed candidate traffic share for a set duration and promote when the timer expires.
B
Controlled, staged exposure and candidate-specific analysis with an abort path support progressive promotion and recovery. Aggregate metrics across both versions can hide a small candidate's failures, and promoting when a timer expires bases the decision on elapsed time rather than measured behavior.
GitOps Patterns
19
Select Two
C
Development and production configurations are stored in separate directories. Development contains a tested image update and an unrelated experimental configuration change. Production must receive the image update but retain its existing settings.
Both environments already reference images by digest.
Which promotion approach best meets this requirement?
Change only the production image digest through a reviewed configuration update.
Replace the production directory with the tested development directory through a reviewed update.
Rebuild the source commit for production and reference the newly generated image digest.
Point production at the development directory and apply its existing differences directly to the cluster.
A
A targeted digest update promotes the tested artifact without importing unrelated development settings. Replacing the production directory includes the experiment, rebuilding produces a different artifact that has not received the stated testing, and applying differences directly to the cluster creates differences outside the authoritative production declaration.
GitOps Patterns
18
Select One
A team automatically builds and tests each integrated application change. It keeps a deployable artifact ready, but a release manager decides when to approve a production configuration update.
Once approved, the GitOps agent deploys the selected artifact automatically.
Which description best fits the release process?
Continuous deployment, because the agent automatically applies approved production configuration.
Continuous integration only, because production releases require a person's decision.
Manual deployment, because the selected artifact is not released immediately after testing.
Continuous delivery, with an approval decision controlling when a production release occurs.
D
Continuous delivery keeps changes releasable while allowing a manual release decision. Automatic reconciliation after approval does not turn the entire process into continuous deployment. Calling it continuous integration only overlooks delivery readiness, and calling it manual deployment confuses release authorization with manual deployment execution.
Related Practices
17
Select One
A GitOps repository is readable by many developers. Deployments need database credentials, but repository readers must not gain access to the plaintext values.
The team also wants configuration-policy violations detected before merge. Production agents can access a separate decryption mechanism.
Which TWO practices meet these requirements?
Store credentials as base64-encoded Kubernetes Secret values in the repository.
Store encrypted secret manifests and grant decryption access to the deployment agents.
Run policy checks against the rendered deployment configuration before approving a merge.
Record policy-check results in commit messages and let reviewers accept the reported result.
B
Encryption protects secret values from repository readers when decryption access is separately controlled, and pre-merge policy checks evaluate the rendered configuration before approval. Base64 is encoding, not protection, and commit-message claims are not executed checks.
Related Practices
16
Select Two
C
A company separates application source code from environment configuration. It wants CI to test and package application changes while a GitOps agent manages deployment.
Which handoff best maintains this separation?
CI builds an image, updates the live Deployment, and then records the image reference in the configuration repository.
CI builds an image and proposes its immutable reference in configuration; the agent deploys the approved change.
CI builds an image and sends its reference to the agent, which uses it instead of the repository's declaration.
CI builds an image under a shared tag and restarts the application so it retrieves the tag's latest contents.
B
CI produces the artifact and proposes its reference; the agent applies approved desired state. Updating the live Deployment first deploys before recording that state, sending the reference to the agent bypasses the repository's declaration, and a shared tag with a restart relies on mutable tag contents and an imperative step.
Related Practices
15
Select One
A team stores declarative infrastructure configuration in Git. An engineer reviews a plan and runs an apply operation when changes are approved.
Afterward, an administrator changes a managed setting directly. The difference persists until the next manually initiated plan and apply.
Which statement best describes the workflow?
It satisfies GitOps because desired state is declarative and stored in a version-control system.
It is imperative infrastructure management because a person initiates the apply operation.
It uses declarative IaC, but lacks the ongoing observation and reconciliation needed for GitOps.
It is continuous deployment because approved infrastructure changes are applied to the environment.
C
Declarative configuration and version control are present, but ongoing reconciliation is absent. Manual initiation does not make the configuration itself imperative, and applying an approved change does not establish continuous deployment.
Related Practices
14
Select One
An organization requires approval before production configuration changes take effect. It also wants the production agent to keep correcting unauthorized runtime changes between releases.
Which workflow best satisfies both requirements?
Require approval before changes enter the tracked production branch, then let the agent reconcile it continuously.
Merge changes immediately, suspend the agent, and resume it when the production release is approved.
Require approval for each reconciliation attempt, including attempts that restore the existing approved configuration.
Let the agent track the development branch and require approval before the pipeline publishes a container image.
A
Approval controls changes to the tracked desired state while reconciliation continues enforcing the approved configuration. Suspending the agent pauses drift correction, approving each reconciliation attempt adds approval to routine restoration, and approving an image does not control the production configuration being tracked.
GitOps Principles
13
Select One
A team proposes using an artifact repository instead of Git as its desired-state store. The repository retains immutable configuration versions, provides access control and change auditing, and allows agents to retrieve a selected version whenever needed.
Agents continuously reconcile the retrieved declarations with the managed systems.
Which assessment best follows the OpenGitOps principles?
The design requires Git because artifact repositories can store packages but cannot serve desired state.
The design qualifies only if the build system also pushes each version into the managed environments.
The design requires a Git mirror because reconciliation agents must retrieve declarations through Git protocols.
The design can satisfy GitOps because the store's capabilities matter more than its product category.
D
Git is the canonical state-store example, but another system can serve the role if it satisfies the required properties. The scenario establishes those capabilities. Neither a Git mirror nor a push-based deployment step is required.
GitOps Principles
12
Select One
Two automation systems manage the same Deployment's replica field. A GitOps reconciler repeatedly sets it to three, while another controller repeatedly sets it to five. Both systems report successful API updates.
Which change most directly addresses the repeated updates?
Increase both reconciliation intervals so that the systems update the field less frequently.
Establish one authority for the field and adjust the other system's management scope.
Configure the systems with different service accounts so their updates can be distinguished.
Add retries to the GitOps reconciler so that its updates are more likely to complete last.
B
The systems have conflicting ownership of the same field. Assigning one authority removes the conflict. Slower intervals, distinct identities, and additional retries may change timing or visibility but do not resolve the competing targets.
GitOps Principles
11
Select One
A desired-state declaration requests an application configuration that the environment cannot currently satisfy because of a resource constraint.
The agent continues observing the system, attempts reconciliation according to its configured policy, and reports the failed attempts.
Which TWO conclusions are consistent with GitOps principles?
The agent must replace the declaration with the observed configuration after its retry limit is reached.
Reconciliation can continue even though the system has not yet converged on the desired state.
A successfully retrieved declaration establishes that the requested configuration is achievable.
Failure feedback can prompt a change to available capacity or an approved change to desired state.
B
Continuous reconciliation describes ongoing observation and attempts to apply desired state; it does not guarantee that every declaration is immediately achievable, and failure feedback can prompt added capacity or an approved change to desired state. Replacing the declaration with the observed configuration changes the target without approval, and successfully retrieving a declaration confuses retrieval with feasibility.
GitOps Principles
10
Select Two
D
An operations team uses Git to store desired state. During cleanup, maintainers regularly rewrite the shared deployment branch and remove superseded configuration history.
The team needs to preserve recoverable versions and an auditable sequence of configuration changes.
Which policy best supports this requirement?
Record changes as new commits, protect retained history, and restrict history-rewriting operations.
Keep the shared branch's latest snapshot and retain pipeline logs describing previous deployments.
Rewrite history after each successful release and preserve only the currently deployed release tag.
Export a weekly repository snapshot and allow maintainers to replace history between snapshots.
A
New commits preserve the sequence of changes, while protections restrict rewriting retained history. Deployment logs do not preserve complete configuration versions, rewriting history removes superseded versions, and weekly snapshots leave gaps between backups.
GitOps Principles
9
Select One
A delivery pipeline builds and tests an application, then publishes its deployment declaration to a versioned state store. The organization wants target environments to retrieve approved configuration without giving the build system deployment credentials for those environments.
Which design satisfies this requirement?
The pipeline invokes an environment-local deployment script that applies the published declaration.
The pipeline sends the rendered declaration to an environment API that applies the submitted payload.
An environment agent retrieves the declaration from the state store and reconciles local resources.
An environment scheduler starts a central pipeline that connects back and applies the declaration.
C
The agent retrieves declarations and manages its own environment, keeping deployment credentials out of the build system. Invoking a script or sending a payload makes deployment depend on a pushed command, and a central pipeline that connects back still gives the pipeline responsibility for reaching the target.
GitOps Principles
8
Select One
A team checks out the same configuration commit on two different days but obtains different deployment results.
The configuration references a container image through a tag that can be overwritten. It also imports a remote configuration base from a branch that receives new commits. Tool versions and local configuration are unchanged.
Which TWO changes address these sources of non-reproducibility?
Pin the remote base to a specific commit instead of following its changing branch.
Sign the top-level repository commit while retaining its existing dependency references.
Configure the reconciler to refresh its local caches before every deployment.
Reference the container image by digest instead of the overwritable tag.
A
A fixed base revision and an image digest remove the two changing dependencies identified in the question. Signing the parent commit does not freeze referenced content, and refreshing caches can expose newer content rather than prevent it.
GitOps Principles
7
Select Two
D
A team is replacing a deployment procedure that creates an application, checks its replica count, and runs additional scaling commands when necessary.
It wants application configuration to remain independent of the procedural steps used to realize it.
Which representation best supports that goal?
A versioned script containing creation, verification, and scaling commands for each supported environment.
A manifest specifying the image, replica count, and configuration that a controller works to establish.
A pipeline defining the order of installation, scaling, and verification tasks for each deployment.
A recorded sequence of API requests that can be replayed when an environment is created.
B
The manifest describes the intended configuration while the controller determines the actions needed. Scripts, pipelines, and recorded request sequences encode procedural steps. Putting procedures in version control does not make their descriptions declarative.
GitOps Principles
6
Select One
A team recreates an application in a new cluster using its GitOps repository. The Deployments, Services, database configuration, and empty database volume are created successfully.
The application's previous customer records are missing.
Which explanation best accounts for the result?
The reconciler must process every historical commit before the application's data becomes available.
The state store must include Kubernetes-generated object identifiers to reconstruct the original records.
Desired-state configuration recreates resources; persistent application data needs a separate recovery process.
The database's records become part of desired state after the first successful reconciliation.
C
Desired-state declarations generally exclude persistent application data such as database contents. Recreating resources does not restore those records. Historical commits, generated object identifiers, and successful reconciliation do not substitute for data recovery.
GitOps Terminology
5
Select One
A configuration repository contains three consecutive commits:
- Commit A contains a working application image.
- Commit B changes only the image reference and introduces a defect.
- Commit C changes an unrelated monitoring setting that must be retained.
The team wants to restore the previous image while preserving the shared branch's history. There are no conflicting changes.
Which action best meets these requirements?
Create and merge a revert of commit B on top of commit C.
Reset the shared branch to commit A and force-push the updated branch.
Change the reconciler's tracked revision to commit A and retain that revision.
Restore the repository's complete tree from commit A in a new commit.
A
A revert creates a new commit reversing commit B's changes while retaining commit C and the existing history. Resetting and force-pushing rewrites shared history, and pointing the reconciler at commit A or restoring the complete tree from commit A restores the whole earlier state, losing the monitoring change.
GitOps Terminology
4
Select One
A platform team wants to understand whether its GitOps feedback loop identifies unsuccessful attempts to reach the declared state.
Which TWO observations provide direct feedback about reconciliation, rather than merely recording a proposed change?
The latest comparison shows that a managed resource still differs from its declared configuration.
The pull request introducing the configuration received the required number of approvals.
The state store recorded a new configuration revision with an authenticated author identity.
The agent reports that the API rejected its latest attempt to update a managed resource.
A
The latest comparison showing remaining divergence and the agent's report of a rejected update both describe what happened in the managed environment. Pull request approvals and recorded configuration revisions describe inputs or prerequisites; they do not show whether reconciliation succeeded.
GitOps Terminology
3
Select Two
D
A GitOps agent checks its source and managed resources periodically. A manual configuration change remains visible for a short period before the agent detects and corrects it.
The checks continue even when no repository commits occur.
How should this behavior be interpreted?
It is scheduled deployment because continuous reconciliation requires immediate correction.
It is event-driven delivery because the manual change initiates a new desired-state version.
It is configuration auditing because periodic checks cannot establish a reconciliation loop.
It is continuous reconciliation because observation and correction recur over time.
D
Continuous means reconciliation continues over time, not that correction is instantaneous. Periodic observation can support that loop. Requiring immediate correction imposes an immediacy requirement, a manual change does not create a new desired-state version, and calling it auditing overlooks the corrective action.
GitOps Terminology
2
Select One
A Git repository declares four replicas for an application. An operator changes the live Deployment to six replicas during an incident. No autoscaler manages this field, and the repository remains unchanged.
The GitOps agent detects the difference but has not yet acted.
Which statement correctly describes the situation?
Six replicas are the desired state because the latest change occurred in the running system.
Four replicas remain the desired state, and the live configuration has drifted from it.
The repository contains stale observed state until the agent records the operator's change.
Both replica counts are desired states until the next successful deployment selects one.
B
The repository still declares four replicas. The direct change alters actual state, creating drift. Treating the runtime edit as desired state, or both counts as desired, treats a runtime edit as an approved declaration, and describing the repository as stale observed state reverses the roles of desired and observed state.
GitOps Terminology
1
Select One
.png)
.svg)
