DevSecOps integrates security into the DevOps culture and CI/CD pipelines. Instead of treating security as an afterthought, DevSecOps ensures security checks, policies, and automated validations are embedded throughout the CI/CD process.

“DevSecOps emphasizes shifting security left, integrating security testing, validation, and compliance into every stage of the CI/CD pipeline. This ensures vulnerabilities are detected early and software is delivered securely.”

Thus, D is correct: DevSecOps culture is essential for CI/CD pipelines to ensure security is baked into software delivery.

In GitOps, the pull-based model continuously reconciles the actual state with the desired state. This makes it resilient to drift, since reconciliation runs regularly. In contrast, event-driven systems only reconcile when an event occurs (e.g., a webhook), which makes them more prone to drift if changes happen outside those events.

“A pull-based reconciliation loop ensures continuous alignment with the desired state. Event-driven reconciliation, triggered only on events, risks system drift if changes occur outside those triggers.”

Thus, the correct answer is D .

Kustomize is a Kubernetes-native configuration management tool that allows manifest customization without modifying the original YAML files. It uses overlays and patches to adapt configurations for different environments.

“Kustomize provides a declarative way to customize Kubernetes manifests by applying patches and overlays. This allows managing multiple environments without duplicating manifest files.”

Thus, the correct answer is D .

Progressive delivery is a GitOps pattern that incrementally rolls out application updates, using methods like canary releases, feature flags, and blue-green deployments. GitOps enhances this by ensuring the rollout is automated and declaratively managed through Git , removing the need for manual traffic switching.

“GitOps enables progressive delivery by declaratively managing rollout strategies such as canary or blue-green deployments. These strategies are applied automatically by controllers, without requiring manual traffic switching.”

Thus, the correct answer is B .

Linting tools are essential in GitOps practices for maintaining consistency, standardization, and quality in configuration files. Automated linters can validate YAML manifests, Helm charts, or Kustomize overlays for formatting and best practices.

“Linters automate the enforcement of formatting and quality rules in declarative configuration files. They ensure standardized structure and reduce errors in GitOps workflows.”

Thus, the correct answer is C .

One of the GitOps principles is Versioned and Immutable , which requires that the Desired State is stored in a system that maintains a complete version history . This allows for auditing, traceability, and rollback.

“The Desired State must be stored in a versioned, immutable system. The State Store must retain a complete version history so changes can be audited and previous states can be restored.”

Thus, the correct answer is B .

The two most widely adopted GitOps controllers in the CNCF ecosystem are ArgoCD and Flux . Both implement the GitOps principles of continuous reconciliation from Git as the source of truth.

“ArgoCD and Flux are the two primary CNCF GitOps controllers. They implement reconciliation loops to ensure the desired state in Git matches the cluster’s actual state.”

Thus, the correct answer is C .

Helm is a Kubernetes package manager widely used in GitOps for packaging, configuring, and deploying complex applications. Helm charts bundle configuration, dependencies, and Kubernetes manifests into reusable, declarative packages that can be applied across multiple clusters.

“Helm charts provide a way to package Kubernetes applications, defining configuration and dependencies declaratively. This allows consistent deployment across clusters in GitOps workflows.”

Thus, the correct answer is A .