Test yourself

Argo CD

Final exam · 14 questions · answers explained as you pick

Beginner

4 questions

01GitOps means…

Apushing changes to the cluster with kubectl from CI

Incorrect — that is the push model GitOps replaces.

BGit is the source of truth; an in-cluster controller pulls and reconciles the cluster to match

Correct — credentials stay in the cluster; deploys are commits.

Cstoring container images in Git

Incorrect — no.

Da CI server

Incorrect — no.

02An Argo CD Application ties together…

Aa source (Git repo/path/revision) and a destination (cluster/namespace) to keep in sync

Correct — the core object of Argo CD.

Btwo containers

Incorrect — no.

Ca secret and a config

Incorrect — no.

Da node and a pod

Incorrect — no.

03Sync status vs health status: an app can be…

Aonly ever both or neither

Incorrect — they are independent.

BSynced only if Healthy

Incorrect — no — they are separate.

CSynced (matches Git) but Degraded (pods failing) — the two are independent

Correct — check health, not just sync, after a change.

DHealthy only if OutOfSync

Incorrect — no relation like that.

04targetRevision: HEAD (a moving branch) means…

Athe app never changes

Incorrect — the opposite.

Bthe app deploys whatever is on that branch now — a merge deploys automatically

Correct — fine for dev; pin a tag/commit for prod and promote deliberately.

Cit encrypts the source

Incorrect — no.

Dit disables sync

Incorrect — no.

Intermediate

5 questions

01automated syncPolicy with prune: true means…

Aresources removed from Git are deleted from the cluster

Correct — blunt and powerful — watch the diff, mind stateful resources.

Bpods are restarted

Incorrect — no.

Csecrets are pruned

Incorrect — no.

Dnothing is deleted ever

Incorrect — that is prune off.

02self-heal in Argo CD…

Ascales nodes

Incorrect — no.

Breverts out-of-band cluster drift back to the Git-declared state

Correct — a manual kubectl edit gets reconciled away.

Cpatches CVEs

Incorrect — no.

Drestarts Argo CD

Incorrect — no.

03A PreSync hook (e.g. a DB migration Job)…

Aruns after the app is deployed

Incorrect — that is PostSync.

Bis optional and ignored on failure

Incorrect — a failure aborts the sync.

Cruns before the main sync, and its failure aborts the rollout

Correct — migrate-before-deploy; keep it idempotent — it is on the critical path.

Dencrypts secrets

Incorrect — no.

04An ApplicationSet is used to…

Agenerate many Applications from a template + generator (per cluster, env, or repo dir)

Correct — fleet-scale GitOps from one templated definition.

Bstore secrets

Incorrect — no.

Crun CI pipelines

Incorrect — no.

Dreplace Helm

Incorrect — no.

05When Argo CD renders a Helm chart source, the rule about secrets is…

Avalues files can hold plaintext secrets safely

Incorrect — no — Git holds them then, in plaintext.

Bkeep secrets out of values/manifests — use SOPS, ESO, or Sealed Secrets

Correct — Argo applies what is in Git; plaintext there = plaintext deployed.

CArgo encrypts values automatically

Incorrect — it does not.

Dsecrets are not needed

Incorrect — they are — just handled safely.

Advanced

5 questions

01An AppProject (Project) is used to…

Astore container images

Incorrect — no.

Brun pipelines

Incorrect — no.

Cconstrain which repos/clusters/namespaces/kinds an app may use — a multi-tenant boundary

Correct — the default project is unrestricted; scope real deployments.

Dencrypt Git

Incorrect — no.

02In GitOps, write access to a synced repo is effectively…

Adeploy access to the cluster — so protect the repo like production

Correct — branch protection, required reviews, signed commits (verified in Argo CD), CODEOWNERS.

Bharmless documentation access

Incorrect — no — merging deploys.

Cread-only

Incorrect — no.

Dunrelated to security

Incorrect — it is central to it.

03A GitOps-safe way to handle secrets is…

Acommit them base64-encoded

Incorrect — base64 is not encryption.

BSealed Secrets, External Secrets Operator, or SOPS — plaintext never in Git

Correct — Git holds ciphertext or a reference; protect the decryption key/store.

Cput them in the Application YAML

Incorrect — that is plaintext in Git.

Demail them

Incorrect — no.

04After bootstrapping Argo CD you should…

Adisable/lock the built-in admin, wire SSO+RBAC, and scope projects and cluster creds

Correct — it is highly privileged — lock access and constrain scope.

Bleave admin open for convenience

Incorrect — a broad standing credential on a privileged system.

Cexpose the UI publicly with no auth

Incorrect — never.

Dgrant every user admin

Incorrect — least privilege — most need sync on their project.

05Compared with Flux, the correct takeaway on security is…

AArgo CD is secure by default, Flux is not

Incorrect — neither is “secure by default”.

BFlux needs no Git protection

Incorrect — it needs the same.

Cboth make Git the deploy authority and hold cluster creds — the hardening is identical

Correct — choose on ergonomics; the GitOps threat model is the same.

Donly Argo CD needs RBAC

Incorrect — both need it.