Top 30 Advanced CI/CD & Automation Concepts Quiz
30 advanced multiple-choice CI/CD & Automation concept questions, the corners that separate having used it from understanding it: internals, edge cases, and the reasons behind the design. They come from 30 bites in the CI/CD & Automation library, the hardest slice of the 172 CI/CD & Automation concept questions in the library. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
GitHub Actions, Terraform, ArgoCD, IaC, pipelines
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
Which is the primary advantage of Pipeline as Code over configuring CI/CD processes via a graphical user interface?
Show the answer
Answer: a · It enables version control, peer review, and auditability of the build and deployment logic.
The core benefit of Pipeline as Code is treating the pipeline definition as a version-controlled file, which allows for reviewable changes and a complete audit history. Option D is incorrect because Pipeline as Code explicitly involves defining the pipeline through code, such as a Jenkinsfile.
Read the full bite: Pipeline as Code: Versioning Your Build Process
Question 2 of 30
According to the 'cattle, not pets' mental model for immutable infrastructure, which action is characteristic?
Show the answer
Answer: a · Building a new server image with all necessary updates and replacing existing instances.
The 'cattle, not pets' model dictates that servers are replaced, not modified. This means building a new image with updates and deploying new instances from it, then decommissioning the old ones. Modifying running instances, even with configuration management, is characteristic of mutable infrastructure.
Read the full bite: Immutable Infrastructure: Treat Servers Like Cattle, Not Pets
Question 3 of 30
Which of the following is the primary security benefit of adopting a pull-based GitOps deployment model?
Show the answer
Answer: a · It prevents the exposure of production cluster credentials to external CI/CD pipelines or systems.
The card states that the pull-based model is more secure as it "avoids exposing cluster credentials externally," contrasting it with the push-based model that "requires giving your CI system powerful, high-risk credentials." Option D describes a general benefit of using Git for configuration, not a specific security advantage of the pull-based model.
Read the full bite: GitOps: Your Git Repo is the Single Source of Truth
Question 4 of 30
Which operation is LEAST suited for an idempotent design in an automation script?
Show the answer
Answer: a · Recording each attempt of a user login into an audit trail.
The card states that "appending a log entry" is an example of an operation where idempotency is the "wrong goal" because you want "each execution to have a distinct effect." The other options describe tasks (package installation, resource provisioning, schema migration) that are explicitly mentioned as scenarios where idempotency is vital for reliable, repeatable automation.
Question 5 of 30
For which project characteristic is GitFlow explicitly recommended?
Show the answer
Answer: d · Software products that are distributed as distinct, versioned releases
GitFlow is designed for projects that produce distinct, versioned releases, such as libraries or desktop applications, to manage the lifecycle of specific versions. It is explicitly advised against for continuously delivered software due to its inherent overhead.
Read the full bite: GitFlow: A Branching Model for Versioned Releases
Question 6 of 30
When is git cherry-pick the most appropriate Git command to use?
Show the answer
Answer: d · To apply a specific bug fix from a development branch to a stable release branch without including other changes.
The card states that cherry-pick is for "backporting a bug fix without merging an entire feature branch" and for applying "a single bug fix... without all the other new, unstable features." Option C describes a standard git merge operation, not cherry-pick.
Read the full bite: Git Cherry-Pick: Copy a Commit to Another Branch
Question 7 of 30
Which scenario would most strongly favor adopting a monorepo strategy over a polyrepo?
Show the answer
Answer: b · A development team needing to perform a single, coordinated update across several interdependent services.
A monorepo excels when dealing with tightly coupled projects and requiring large-scale atomic refactors, as a single commit can update multiple interdependent services. The other options describe scenarios where a polyrepo's autonomy and simpler default setup would be more advantageous.
Read the full bite: Monorepo vs. Polyrepo: One Repository or Many?
Question 8 of 30
To ensure Git LFS manages large files that were already committed to a repository's history, what is the necessary action?
Show the answer
Answer: b · Use git lfs migrate to convert the existing large files in the repository's history.
The card explicitly states that 'git lfs track does not apply retroactively' and that users 'must use git lfs migrate to convert large files already committed to the repository's history'. Other options either only affect new files or are not the specific LFS tool for this task.
Read the full bite: Git LFS: Versioning Large Files Without Bloating Your Repo
Question 9 of 30
Which scenario presents the most significant challenge or risk for adopting an incremental build model?
Show the answer
Answer: c · The core architectural foundation is highly unstable, potentially leading to expensive redesigns in later stages.
The card states that incremental builds are a "poor fit if the core architecture is highly uncertain, as early increments might be built on flawed assumptions that require costly rework later." This highlights the significant risk of an unstable architectural foundation. Options B and D describe key benefits and purposes of the incremental build model, not its challenges.
Read the full bite: Incremental Build: Develop and Ship Software in Pieces
Question 10 of 30
What core problem do reproducible builds solve for distributed software?
Show the answer
Answer: c · User inability to verify a distributed binary's source code origin.
Reproducible builds primarily address the issue where users cannot independently verify that a distributed executable was built from its claimed public source code, which is crucial for trust and security. While they do involve making build environments consistent (option B), this is a method to achieve reproducibility, not the fundamental problem it solves for end-user verification.
Question 11 of 30
Which scenario would generally make cross-compilation a less ideal choice compared to native compilation?
Show the answer
Answer: b · Compiling code that requires immediate execution of helper tools on the build machine as part of the build process.
Cross-compilation complicates build scripts that compile and then immediately run a tool, as the tool would need to be built for the host architecture. In contrast, developing for embedded systems (Option A) is a primary reason to use cross-compilation due to resource constraints.
Read the full bite: Cross-Compilation: Build Anywhere, Run Elsewhere
Question 12 of 30
What is the primary benefit of using a build matrix in a CI/CD pipeline?
Show the answer
Answer: c · It ensures comprehensive testing by automatically generating jobs for all specified environment permutations.
A build matrix's main purpose is to automatically create and run jobs for every combination of defined configurations, ensuring comprehensive compatibility testing. It does not reduce the total number of jobs, but rather increases them to cover all permutations, while reducing manual configuration effort.
Question 13 of 30
What is the primary benefit of using mutation testing over relying solely on traditional code coverage metrics?
Show the answer
Answer: c · It assesses the test suite's actual ability to detect functional errors and behavioral regressions.
Mutation testing's core purpose is to measure a test suite's actual effectiveness at finding bugs and validating behavior, which traditional code coverage often misses. Option B describes code coverage itself, while options A and D misrepresent the scope or function of mutation testing.
Read the full bite: Mutation Testing: A Fire Drill for Your Test Suite
Question 14 of 30
A security team uses DAST in their CI/CD pipeline. Which vulnerability type is DAST least effective at identifying?
Show the answer
Answer: c · A flaw allowing a user to bypass payment for an item.
DAST operates from the outside without seeing source code, making it ineffective at detecting business logic errors, such as a flaw allowing unauthorized transactions. It excels at finding common web vulnerabilities like XSS, SQL injection, and server misconfigurations by attacking the running application.
Read the full bite: DAST: Probing a Running App for Security Flaws
Question 15 of 30
The mental model for Test Data Management (TDM) is often compared to 'infrastructure as code' because it:
Show the answer
Answer: d · Defines, versions, and automatically provisions exact data states required for tests.
The card states TDM is 'infrastructure as code' but for your test data, meaning it defines, versions, and automatically provisions the exact data states. Option A describes infrastructure as code for infrastructure, not for data, which is the specific focus of TDM.
Read the full bite: Test Data Management (TDM): Stop Flaky Tests
Question 16 of 30
A security team uses an SBOM to identify all instances of a newly discovered vulnerable library. What critical piece of information does the SBOM not directly provide regarding this vulnerability?
Show the answer
Answer: c · Whether the vulnerable library is actually called or configured in a way that makes the application exploitable.
The card states that an SBOM "tells you what components you have, but not if they are configured or used in a vulnerable way." This means it doesn't confirm if a vulnerable component is actually exploitable in the product's specific context. This additional context is typically provided by a VEX document, not the SBOM itself. The other options describe information that an SBOM is designed to provide.
Read the full bite: Software Bill of Materials (SBOM): An Ingredient List for Your Code
Question 17 of 30
What is the primary risk when a build tool automatically resolves a dependency conflict by selecting a single version?
Show the answer
Answer: b · The application might compile successfully but experience runtime failures due to API incompatibilities.
The card emphasizes that automatic resolution is a 'ticking time bomb' because the application can compile successfully but crash at runtime due to incompatible API changes (e.g., NoSuchMethodError). Build tools typically include only one version, making options about multiple versions or immediate build failure incorrect.
Read the full bite: Dependency Conflict: When Your Dependencies Disagree
Question 18 of 30
What is the primary problem artifact promotion aims to solve in a software delivery pipeline?
Show the answer
Answer: b · Preventing "it worked in staging" failures caused by subtle differences introduced when rebuilding for each environment.
The card explicitly states that artifact promotion solves "it worked in staging" failures caused by rebuilding for each environment, which introduces subtle differences. Option A is incorrect because environment-specific configuration is injected at runtime, not baked into the artifact.
Read the full bite: Artifact Promotion: Build Once, Deploy Everywhere
Question 19 of 30
Which mechanism is central to how artifact vulnerability scanning identifies security risks?
Show the answer
Answer: a · Comparing an artifact's component list against known vulnerability databases.
The card explicitly states that artifact vulnerability scanning works by identifying components in an artifact (creating an SBOM) and then comparing this list against vulnerability databases. Options A and B describe Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), respectively, which are different security practices.
Read the full bite: Artifact Vulnerability Scanning: A Background Check for Code
Question 20 of 30
When is it generally LEAST advisable to use a pipeline template?
Show the answer
Answer: a · When the logic is highly specific and unique to a single project
The card explicitly states to avoid templates for "logic that is truly unique to a single project" to prevent over-abstraction and complexity. The other options describe scenarios where templates are beneficial or how they function, making them suitable for template implementation.
Read the full bite: Pipeline Templates: Reusable CI/CD Building Blocks
Question 21 of 30
To coordinate dependencies where a shared library in one repository triggers tests in multiple dependent microservices in other repositories, which dynamic pipeline strategy is best?
Show the answer
Answer: c · Using a multi-project pipeline where the shared library's successful build triggers pipelines in the microservice repositories.
Multi-project pipelines are designed for coordinating dependencies across distinct repositories, allowing one project (like a shared library) to trigger pipelines in others. Parent-child pipelines are used for dynamic logic within a single project, not across separate ones.
Read the full bite: Dynamic Pipelines: Parent-Child vs. Multi-Project
Question 22 of 30
When should a developer prefer using Conftest over the general-purpose opa eval command in a CI/CD pipeline?
Show the answer
Answer: a · For validating static configuration files like Infrastructure as Code.
The card states that Conftest is the better choice for validating static configuration files, especially Infrastructure as Code, because it is designed to parse formats like HCL and Jsonnet that opa eval does not natively support. The opa eval command is intended for runtime data and integrating different tools that output JSON or YAML.
Question 23 of 30
Which statement best describes a core advantage of Pulumi's approach to Infrastructure as Code compared to DSL-based tools?
Show the answer
Answer: d · It enables the use of general-purpose programming constructs like loops and classes for resource definition.
The card highlights that Pulumi uses real programming languages, allowing for complex logic, code reuse, and constructs like loops and classes, which DSLs often limit. Option B is incorrect because while Pulumi aims for clarity, using full programming languages can lead to more complex code than a purely declarative DSL, as noted in the 'When Not To Use It' section.
Read the full bite: Pulumi: Infrastructure as Code with Real Programming Languages
Question 24 of 30
What is the primary motivation for adopting Terragrunt in a Terraform project that is experiencing growth?
Show the answer
Answer: c · To reduce configuration duplication and automate repetitive operational tasks across environments.
Terragrunt's core purpose is to solve the structural problems of growing Terraform projects by keeping configurations DRY (Don't Repeat Yourself) and automating repetitive tasks across multiple modules and environments. Option D is incorrect because Terragrunt acts as a wrapper that orchestrates the existing Terraform CLI, rather than replacing it entirely, to achieve these goals.
Read the full bite: Terragrunt: A Thin Wrapper for DRY Terraform
Question 25 of 30
Which statement accurately describes the role of Open Policy Agent (OPA) in a system?
Show the answer
Answer: d · OPA evaluates policy rules against provided data and returns a decision, which the calling service then enforces.
OPA's core function is to evaluate policies against input data and return a decision. The application or service interacting with OPA is then responsible for enforcing that decision, not OPA itself. OPA is explicitly stated not to be a database or secret management tool, and while it centralizes policy logic, it doesn't replace all conditional logic.
Read the full bite: Open Policy Agent (OPA): Centralized Policy as Code
Question 26 of 30
Which task is generally considered an inappropriate use case for cloud-init?
Show the answer
Answer: b · Regularly enforcing desired state configuration across a fleet of running servers.
Cloud-init is designed for initial, one-time setup during a cloud instance's first boot. It is not intended for ongoing configuration management or regularly enforcing desired state, which are tasks better suited for dedicated configuration management tools.
Read the full bite: Cloud-Init: Bootstrapping Cloud Instances
Question 27 of 30
What is the primary mechanism by which a Kubernetes Sealed Secret is transformed into a usable Kubernetes Secret?
Show the answer
Answer: d · A dedicated controller within the target Kubernetes cluster uses a private key to decrypt the SealedSecret.
The Sealed Secrets controller, running within the target cluster, is responsible for decrypting the SealedSecret using its private key. The kubeseal CLI tool is used for encryption, not decryption, and the Kubernetes API server does not perform the decryption itself.
Read the full bite: Kubernetes Sealed Secrets: Git-Friendly Secret Management
Question 28 of 30
What is the fundamental mechanism by which External Secrets Operator (ESO) enables Kubernetes applications to consume secrets from external providers?
Show the answer
Answer: c · It creates and continuously updates native Kubernetes Secret objects with data from external secret management systems.
ESO acts as a bridge, fetching secrets from external providers and then creating or updating standard Kubernetes Secret objects. Applications then consume these native Kubernetes Secrets. Option D is incorrect because applications interact with the native Kubernetes Secrets, not a direct API provided by ESO to the external store.
Read the full bite: External Secrets Operator: Sync Secrets into Kubernetes
Question 29 of 30
A development team is deploying a clustered database that requires each instance to maintain its own persistent data and a stable network identity across restarts. Which Kubernetes workload resource is the most suitable choice?
Show the answer
Answer: a · A StatefulSet, because it provides stable, unique network identities and persistent storage for each pod.
StatefulSets are specifically designed for stateful applications, offering stable network identities and persistent storage for each pod, which is crucial for clustered databases. Deployments treat pods as interchangeable and stateless, making them unsuitable for applications requiring unique identities and persistent data.
Read the full bite: Kubernetes StatefulSets: Stable Identity for Pods
Question 30 of 30
A development team struggles with inconsistent retry logic and security policies across 50 microservices. How would a service mesh primarily address this challenge?
Show the answer
Answer: c · It transparently intercepts and manages inter-service communication, applying uniform policies via sidecar proxies.
A service mesh extracts networking logic from application code, using sidecar proxies to transparently enforce uniform policies like retries and security across all inter-service communication. Option B describes an API Gateway, which manages external traffic, not internal service-to-service communication. Option A describes the problem a service mesh solves, not its solution.
Read the full bite: Service Mesh: The Network Layer for Your Microservices
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.