Use ConfigMaps and Secrets to Configure Applications CKA Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   A Secret is mounted as a volume in a pod. The Secret is immutable. The team needs to rotate the credentials. What is the correct approach?

   • ADelete the Secret and recreate it with the same name.
   • BEdit the Secret in place; immutability only prevents deletion.
   • CCreate a new Secret with the new credentials and update the pod to reference the new Secret.
   • DUse kubectl rollout restart to force the Secret to update.
   Reveal Solution Discussion Select an answer first
2. 27expert · medium

   A pod needs to consume a ConfigMap as environment variables. The ConfigMap has keys with dashes (e.g., 'db-host'). The application expects an environment variable DB_HOST. How can you map the key to a different environment variable name?

   • AUse env with name: DB_HOST and valueFrom.configMapKeyRef with key: db-host
   • BUse command substitution to read the value from a mounted volume.
   • CUse envFrom with prefix: DB_ and rely on the key name.
   • DRename the key in the ConfigMap to 'db_host'.
   Reveal Solution Discussion Select an answer first
4. 28expert · medium

   A Secret named 'app-secret' has a key 'password' that is base64 encoded. The pod must receive the decoded value as an environment variable. Which configuration achieves this?

   • AUse a ConfigMap instead because it stores plain text.
   • BMount the Secret as a volume and read the file, then decode it in the container.
   • CUse env with secretKeyRef and then run a command to decode it in the container.
   • DUse env with secretKeyRef; Kubernetes automatically decodes the base64 value.
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A cluster has a private registry that requires authentication. The administrator creates a Secret of type docker-registry. However, the image pull still fails. What is the most likely cause?

   • AThe Secret type is incorrect.
   • BThe Secret is not mounted as a volume.
   • CThe Secret is not injected as an environment variable.
   • DThe Secret is not referenced in the pod's imagePullSecrets field.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An application requires a database password that is stored in a Secret named 'db-secret' under the key 'password'. The security team mandates that the Secret cannot be modified after creation. The application pod must receive the password as an environment variable DB_PASSWORD. Which configuration satisfies both requirements?

   • AMount the Secret as a volume and read the file in the container startup script.
   • BUse a ConfigMap instead of a Secret because it can be made immutable.
   • CCreate the Secret with immutable: true and use env with secretKeyRef to inject DB_PASSWORD.
   • DCreate the Secret without immutable and use envFrom to import all keys.
   Reveal Solution Discussion Select an answer first