CGOA Certified GitOps Associate Exam Topics and Questions
These Linux Foundation Certified GitOps Associate Exam (CGOA) exam topics are organized according to official exam domains to help candidates quickly verify coverage and focus on assessment rather than theory. Each domain is paired with topic-wise CGOA sample questions that reflect how objectives are tested in the actual exam. This structure enables efficient review, targeted self-assessment, and rapid identification of weak areas when preparing for the Linux Foundation Certified GitOps Associate Exam certification exam.
Let's Practice Free Linux Foundation CGOA Questions Aligned with Official Exam Topics
GitOps has its own precise vocabulary, and the exam treats that vocabulary as load-bearing. Misread a term and you will pick the wrong option even when you understand the underlying concept. This topic sets the definitional foundation for everything that follows: the words used here reappear in every other topic, so gaps here multiply into missed points elsewhere. The density of terminology questions makes this a high-efficiency study target. – What the system is and what it should look like...
GitOps has its own precise vocabulary, and the exam treats that vocabulary as load-bearing. Misread a term and you will pick the wrong option even when you understand the underlying concept. This topic sets the definitional foundation for everything that follows: the words used here reappear in every other topic, so gaps here multiply into missed points elsewhere. The density of terminology questions makes this a high-efficiency study target.
– What the system is and what it should look like
Three terms anchor the model: the desired state, the state store, and the GitOps managed software system. Desired state is the authoritative description of what should be running, expressed in a form the system can act on automatically. The state store is where that description lives, versioned and accessible. A GitOps managed software system is one whose actual running state is governed by reconciling against that store. The exam tests whether you can distinguish these from each other and from related but different ideas. Declarative description is the property that makes desired state machine-readable: it says what, not how. Knowing why that distinction matters operationally is more useful than memorising a definition.
– What happens when reality diverges from intention
State drift is the condition where the live system no longer matches the desired state. State reconciliation is the automated process that closes that gap. The exam expects you to know which direction reconciliation runs, what triggers it, and what the feedback loop does in that cycle. The feedback loop is the mechanism by which the system reports its current state back so drift can be detected. Rollback in a GitOps context means reverting the state store to a previous version and letting reconciliation do the rest: it is not a manual intervention on the running system. Candidates who conflate rollback with a direct cluster operation consistently lose points here. Continuous, as a modifier, means the reconciliation never stops: it is not a synonym for frequent or scheduled.
How GitOps Terminology is tested
At 19% of the exam, this topic produces a meaningful share of items. Most of them are scenario-based: the stem describes a situation and asks you to name the condition or mechanism at play. Items reward precise distinctions between terms that are adjacent in meaning. Drift and reconciliation are favourite targets because candidates who learned them loosely will pick the plausible-sounding option rather than the technically exact one. The feedback loop and the continuous modifier are often tested together, because conflating them with monitoring or scheduled pipelines is a predictable mistake. Rollback questions are designed to catch candidates who import a non-GitOps mental model: the trap option usually involves a direct intervention on the live system. Items on the GitOps managed software system tend to test scope, asking what does and does not fall under GitOps control. Read each stem for the exact term being examined before looking at the options.
The ITExamsTopics practice test covers all nine sub-topics in this domain. Working through a full bank lets you see which terms you are confusing under timed pressure, which is a harder signal to get from re-reading a glossary. A free demo is available before you commit.
The question below targets one of the most commonly misapplied terms in this topic. Work through it before checking your reasoning.
Which of the following statements accurately describes the role of GitOps in progressive delivery?
With the terminology in place, the exam shifts to the four principles that define whether a system is genuinely operating under GitOps. At 28%, this is the single heaviest topic on the exam. The principles are not independent: they interlock, and questions often test what breaks when one is missing. Expect to reason about why each principle is required, not just what it says. – Declarative and versioned The declarative principle requires that the entire system state be expressed as...
With the terminology in place, the exam shifts to the four principles that define whether a system is genuinely operating under GitOps. At 28%, this is the single heaviest topic on the exam. The principles are not independent: they interlock, and questions often test what breaks when one is missing. Expect to reason about why each principle is required, not just what it says.
– Declarative and versioned
The declarative principle requires that the entire system state be expressed as data the tooling can interpret, with no procedural steps embedded. The exam tests whether you can identify what violates this: a script that imperatively patches a resource fails the principle even if its output matches the desired state. Versioned and immutable goes further by requiring that every change to the desired state be recorded and that past states cannot be silently overwritten. Immutability is the part candidates underweight. The exam distinguishes between a system that versions its state and one that versions it immutably: the difference matters when a question asks what guarantees auditability or enables reliable rollback. These two principles together are what make the state store the source of truth rather than just a convenient location.
– Pulled automatically and continuously reconciled
Pulled automatically means the agent inside or alongside the target environment fetches desired state from the store on its own initiative: nothing outside pushes changes in. The exam uses this principle to draw a hard line between GitOps and push-based CD pipelines. A pipeline that applies manifests directly to a cluster is not GitOps, even if it reads from Git. The distinction shows up in scenario questions where you must classify a described workflow. Continuously reconciled means the agent does not apply state once and stop: it loops, detects drift, and corrects it without human instruction. Questions on this principle often test what happens when reconciliation is disabled or when an out-of-band change is made to the live system. The expected outcome, drift correction on the next reconciliation cycle, is what items reward. Candidates who describe reconciliation as event-only rather than continuous lose marks here.
How GitOps Principles is tested
At 28%, this topic generates more items than any other. The Linux Foundation frames questions around application of the principles, not recitation of them. A stem will describe a workflow or an architectural decision and ask whether it satisfies one or more principles, or which principle it violates. Items reward the ability to spot a violation in a described system: the trap options tend to be systems that satisfy the spirit of GitOps without meeting the letter of a specific principle. Pull versus push is a reliable trap: a pipeline that reads from Git but pushes to the cluster satisfies neither the pulled nor the continuously reconciled principle, and the exam exploits that. Immutability questions catch candidates who treat versioning and immutability as synonyms. Expect some items to combine two principles in a single scenario, requiring you to evaluate both before selecting. Rushing the stem on this topic is the most common source of lost marks.
Because this topic accounts for more than a quarter of the exam, seeing a wide variety of item styles across all four principles before exam day matters. The ITExamsTopics practice test lets you filter by topic and work this domain until your miss rate is flat. PDF and practice test formats are included on one purchase.
The question below presents a described workflow and asks you to apply one of the four principles. Read the scenario carefully before choosing.
In the context of GitOps, what happens to a GitOps-managed Kubernetes cluster if there is drift divergence?
GitOps does not exist in isolation. This topic positions it relative to practices that either enable it or share its goals: Configuration as Code, Infrastructure as Code, DevOps and DevSecOps, and CI/CD. The exam tests whether you understand the relationships and boundaries, not just whether you can define each practice. Candidates who treat this as a lighter topic because of its 15% weight often underestimate how many questions hinge on knowing where one practice ends and another begins. – Code-as-truth...
GitOps does not exist in isolation. This topic positions it relative to practices that either enable it or share its goals: Configuration as Code, Infrastructure as Code, DevOps and DevSecOps, and CI/CD. The exam tests whether you understand the relationships and boundaries, not just whether you can define each practice. Candidates who treat this as a lighter topic because of its 15% weight often underestimate how many questions hinge on knowing where one practice ends and another begins.
– Code-as-truth practices
Configuration as Code and Infrastructure as Code both treat system definitions as versioned files rather than manual settings. The exam uses them to establish what GitOps inherits and what it adds. IaC defines infrastructure declaratively; CaC does the same for application configuration. GitOps takes both as inputs and adds the reconciliation loop and the pull model on top. Questions in this area test whether you can identify what IaC or CaC alone does not provide: automated drift correction and a single source of truth enforced at runtime. Candidates who treat IaC as synonymous with GitOps lose marks on these items. The distinction is operational, not philosophical: IaC describes; GitOps also enforces.
– Pipeline practices and security culture
CI and CD are the delivery practices GitOps most often works alongside, and the exam tests the boundary carefully. Continuous Integration covers building and testing code changes; Continuous Delivery or Deployment covers getting those changes to an environment. GitOps replaces the push step in a CD pipeline with a pull-based reconciliation loop: the pipeline writes to the state store, and the GitOps agent takes it from there. Questions here reward knowing exactly where the handoff occurs. DevOps is the cultural and organisational context; DevSecOps extends it by embedding security into every stage. The exam asks where security controls fit in a GitOps workflow, and items reward placing them at the state store and the reconciliation layer rather than only at the CI boundary. Treating security as a CI-only concern is the trap.
How Related Practices is tested
At 15%, this topic produces a moderate number of items, but they tend to be comparative: a stem describes a practice or a workflow and asks you to classify it, relate it to GitOps, or identify what it lacks. Items reward knowing the boundary between CI/CD and GitOps precisely enough to classify a described pipeline correctly. The IaC-versus-GitOps distinction appears frequently because it is the most tempting conflation. DevSecOps questions tend to focus on where in the GitOps workflow security controls are applied, and the items reward placing controls at the right layer rather than at the most familiar one. Candidates who have a strong CI/CD background sometimes over-apply that mental model here: the exam will present scenarios designed to expose that. Reading the stem for what the question is actually classifying, rather than what it superficially resembles, is the discipline this topic demands.
Comparative questions are harder to self-assess from reading alone. Using the ITExamsTopics practice test to check your ability to draw these boundaries under timed conditions gives you a more accurate picture of where you stand than reviewing notes does. Try the free demo to see the item style.
The question below asks you to draw a boundary between two of the practices covered in this topic. Take your time with the scenario before selecting.
Principles tell you what GitOps requires; patterns tell you how practitioners implement it. At 19%, this topic tests your ability to recognise and reason about the structural decisions that shape a GitOps system: how deployments are staged, how changes reach production, where the reconciler runs, and what drives it. The exam moves from abstract principles into concrete architectural choices, and the questions expect you to evaluate trade-offs rather than just name patterns. – Getting changes to production safely Deployment and...
Principles tell you what GitOps requires; patterns tell you how practitioners implement it. At 19%, this topic tests your ability to recognise and reason about the structural decisions that shape a GitOps system: how deployments are staged, how changes reach production, where the reconciler runs, and what drives it. The exam moves from abstract principles into concrete architectural choices, and the questions expect you to evaluate trade-offs rather than just name patterns.
– Getting changes to production safely
Deployment and release patterns cover how a change moves from the state store to a running environment. The exam tests whether you can distinguish deployment from release: a deployment makes a version available; a release exposes it to users. GitOps patterns often separate these two events deliberately, and questions reward understanding why. Progressive delivery patterns extend this by controlling the blast radius of a change: canary, blue-green, and traffic-splitting approaches all exist to limit exposure before full rollout. The exam does not require deep tool knowledge here, but it does expect you to match a described risk-management goal to the pattern that serves it. Candidates who treat progressive delivery as simply slow deployment miss the control-plane logic that makes it useful.
– How changes are detected and where the reconciler lives
Pull versus event-driven is one of the sharper distinctions in this topic. A pull-based reconciler polls the state store on a schedule and applies any delta it finds. An event-driven reconciler acts when notified of a change. The exam tests the operational consequences of each: pull-based systems tolerate state store outages better; event-driven systems react faster but depend on reliable notification. Neither is universally superior, and questions reward knowing the trade-off. Architecture patterns cover where the reconciler runs relative to the cluster it manages. An in-cluster reconciler has direct API access but is affected by cluster failures. An external reconciler survives cluster problems but needs credentials and network access. State store management questions ask about access controls, branching strategies, and how multiple environments map to repositories or directories. These are not abstract: the exam expects you to evaluate a described setup and identify its implications.
How GitOps Patterns is tested
At 19%, this topic matches GitOps Terminology and Tooling in weight. Items here are the most architectural on the exam: a stem describes a system or a requirement and asks which pattern fits, or asks what a described pattern implies for reliability, security, or operational behaviour. Items reward matching a stated constraint to the pattern that satisfies it. The pull-versus-event-driven distinction is a reliable source of items because the trade-offs are non-obvious and scenario-dependent. In-cluster versus external reconciler questions tend to target failure modes: what happens when the cluster is unavailable, and which architecture is affected. Progressive delivery questions reward understanding the goal of exposure control rather than the mechanics of any specific tool. Candidates who memorise pattern names without understanding the problem each solves will find the scenario framing disorienting. The discipline here is reading the requirement in the stem before scanning the options.
Pattern questions are the ones where seeing multiple item variations makes the biggest difference: the same architectural concept appears in different scenario framings, and volume is what trains you to recognise it. The ITExamsTopics practice test provides that coverage across all four sub-topics in this domain.
The question below puts you in a scenario that requires choosing between two architectural approaches. Identify the operative constraint before you evaluate the options.
The final topic grounds everything in the actual tools a GitOps practitioner reaches for. At 19%, it carries the same weight as Terminology and Patterns, but the questions here are the most concrete: manifest formats, state store choices, reconciliation engines, and the integrations that connect GitOps to the rest of a delivery platform. You are not expected to be a tool expert, but you are expected to know what each category of tooling does and where the meaningful differences between...
The final topic grounds everything in the actual tools a GitOps practitioner reaches for. At 19%, it carries the same weight as Terminology and Patterns, but the questions here are the most concrete: manifest formats, state store choices, reconciliation engines, and the integrations that connect GitOps to the rest of a delivery platform. You are not expected to be a tool expert, but you are expected to know what each category of tooling does and where the meaningful differences between options lie.
– Describing and storing desired state
Manifest format and packaging covers how desired state is expressed in files the reconciler can consume. Kubernetes YAML is the baseline, but Helm charts and Kustomize overlays are both in scope because they change how manifests are generated and versioned. The exam tests whether you understand what each format implies for the reconciliation loop: raw YAML is straightforward to diff; templated formats introduce a rendering step that has its own failure modes. State store systems covers Git as the canonical choice and the alternatives that exist when Git does not fit. The exam expects you to know what properties a state store must have to support GitOps, and to evaluate whether a described alternative satisfies them. An object store or an OCI registry can act as a state store under specific conditions, and questions may probe those conditions.
– Engines and integrations
Reconciliation engines are the agents that watch the state store and drive the live system toward desired state. ArgoCD and Flux are the two named examples in the syllabus, and the exam tests their broad operational models rather than their CLI syntax. ArgoCD uses an application abstraction and a centralised server; Flux uses a set of controllers and leans on Kubernetes-native primitives. Questions reward knowing the model, not memorising flags. Alternatives exist and the exam may describe one without naming it, expecting you to evaluate it against the principles. Interoperability questions cover how a GitOps system connects to notification systems, observability platforms, and CI tools. The exam tests the integration points: where a CI system hands off to the GitOps layer, how alerts are generated from reconciliation events, and what observability data a reconciler should expose. These questions reward understanding the data flow rather than the configuration of any specific integration.
How Tooling is tested
At 19%, Tooling items tend to be the most scenario-specific on the exam, describing a concrete setup and asking you to evaluate it. Items reward knowing the operational model of ArgoCD and Flux well enough to distinguish their approaches without needing to recall command syntax. Manifest format questions reward understanding the rendering pipeline: candidates who treat Helm and raw YAML as equivalent lose marks when a question turns on what happens at generation time. State store questions are often framed around requirements: a described system has a constraint, and you must identify whether a proposed store satisfies it. Interoperability questions are the ones candidates most often skip in study, and the exam reflects that by including them: knowing where CI ends and GitOps begins, and how observability data flows out of a reconciler, are both testable. The strongest preparation for this topic is being able to describe what each tool category does to the GitOps loop, not just that it exists.
The ITExamsTopics practice test lets you isolate this topic and check your coverage across all four sub-topics before exam day. If you want to see the item style and difficulty before purchasing, the free demo includes questions from across the full exam.
The question below focuses on one of the tool categories in this topic. Think about the operational model before committing to an answer.
Ready to Start Practicing?
Access all questions and start your exam preparation journey
Upgrade to Full CGOA Exam Questions 🚀
