Advanced CI/CD test (Advanced)

Sample questions

5 sample questions from the Advanced CI/CD test, with the answers. Samples are taken out of the live test, so you will not meet these when you sit it.

1. Which of the following is a critical process in ensuring the integrity and authenticity of software components throughout the supply chain?

   1. Supply chain attestation
   2. Argo CD health checks
   3. Flux controller reconciliation
   4. GitOps reconciliation

   Answer: A. Supply chain attestation

   Supply chain attestation refers to the process of verifying the integrity and authenticity of software components throughout the supply chain, ensuring that all artifacts are trusted and have not been tampered with. This is a key aspect of supply chain security, as it provides assurance about the provenance and reliability of the software being used.

2. Which of the following statements accurately describes Flux's integration with the Helm operator?

   1. Flux fully supports Helm operator integration out of the box.
   2. Flux requires the Helm operator to be installed separately for any Helm chart deployment.
   3. Flux does not support Helm operator integration directly; it uses Helm charts via the Helm controller.
   4. Flux only supports Helm operator integration in Kubernetes clusters running version 1.20 or higher.

   Answer: C. Flux does not support Helm operator integration directly; it uses Helm charts via the Helm controller.

   Flux does not have a direct integration with the Helm operator. Instead, Flux uses Helm charts through the Helm controller, which is a different component. This is a common point of confusion, as some may assume Flux has direct operator integration with Helm.

3. Which of the following is a key practice for ensuring supply chain security in CI/CD pipelines?

   1. Argo CD health checks
   2. Flux controller reconciliation
   3. Monorepo pipeline parallelism
   4. Trivy integration in CI

   Answer: D. Trivy integration in CI

   Trivy is a tool used for vulnerability scanning and is commonly integrated into CI/CD pipelines to ensure supply chain security by identifying vulnerabilities in container images, code, and configuration files. The other options are either unrelated to supply chain security or are not tools used for this purpose.

4. Which of the following is the primary process that ensures the actual state of the cluster aligns with the desired state defined in a Git repository in Argo CD?

   1. Argo CD app reconciliation
   2. Flux controller reconciliation
   3. Argo CD health checks
   4. GitOps declarative configuration

   Answer: A. Argo CD app reconciliation

   Argo CD app reconciliation is the process by which Argo CD synchronizes the actual state of the cluster with the desired state defined in the Git repository. This is a core feature of GitOps and is essential for maintaining consistency between the cluster and the source of truth. The other options are either related to different tools or concepts but do not directly represent the core process of GitOps reconciliation.

5. Which of the following best describes how supply chain vulnerability scanning typically works in a CI/CD pipeline?

   1. It integrates with the deployment phase to patch vulnerabilities automatically.
   2. It relies on manual code reviews to identify vulnerabilities.
   3. It scans the source code for security vulnerabilities after deployment.
   4. It uses SCA tools to analyze dependencies during the build phase.

   Answer: D. It uses SCA tools to analyze dependencies during the build phase.

   Supply chain vulnerability scanning works by integrating Software Composition Analysis (SCA) tools during the build phase to identify and flag vulnerabilities in dependencies. This ensures that any insecure packages are detected before deployment. Other options are either incorrect or relate to different aspects of the CI/CD pipeline.