Workload and Data Security CKS Practice Questions (Page 6)

Questions 26–28

1. 26foundation · easy

   What is a recommended practice for managing secrets in a Kubernetes cluster?

   • AUse the same secret for all applications
   • BStore secrets in a Git repository for versioning
   • CEmbed secrets directly in container images
   • DUse an external secret management tool like HashiCorp Vault
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which Pod Security Admission mode rejects pod creation if the pod violates the configured policy?

   • Aaudit
   • Bwarn
   • Cenforce
   • Dmonitor
   Reveal Solution Discussion Select an answer first
3. 28expert · hard

   You have enabled encryption at rest for Secrets in etcd using the aescbc provider. You need to rotate the encryption key. Which sequence of steps should you follow to rotate the key with minimal risk of data loss?

   • ADelete all Secrets and recreate them with the new key.
   • BReplace the old key with the new key in the EncryptionConfiguration and restart the API server.
   • CRestart the API server with the new key without updating the EncryptionConfiguration file.
   • DAdd the new key as the first provider in the EncryptionConfiguration, restart the API server, then remove the old key and restart the API server again.
   Reveal Solution Discussion Select an answer first