CKA ConfigMaps and Secrets 2

Question 1

What is the default type of a Kubernetes Secret when created with 'kubectl create secret generic'?

Accepted Answer

Opaque

Answer

kubernetes.io/tls

Answer

kubernetes.io/dockerconfigjson

Answer

kubernetes.io/service-account-token

Question 2

How is Secret data stored in etcd by default in a Kubernetes cluster?

Accepted Answer

Base64-encoded but not encrypted

Answer

AES-256 encrypted

Answer

Plain text

Answer

Hashed with SHA-256

Question 3

Which kubectl command creates a Secret of type 'kubernetes.io/dockerconfigjson' for pulling images from a private registry?

Accepted Answer

kubectl create secret docker-registry

Answer

kubectl create secret generic --type=docker

Answer

kubectl create secret tls --registry

Answer

kubectl create secret registry-auth

Question 4

What Secret type should be used to store a TLS private key and certificate pair?

Accepted Answer

kubernetes.io/tls

Answer

kubernetes.io/ssl

Answer

Opaque

Answer

kubernetes.io/cert

Question 5

What is the purpose of the 'stringData' field in a Secret manifest?

Accepted Answer

It allows providing plain text values that Kubernetes will automatically base64-encode

Answer

It stores decoded values that bypass base64 encoding at runtime

Answer

It accepts only ASCII strings and rejects binary data

Answer

It is an alias for 'data' with no functional difference

Question 6

What happens to a Pod if it references a Secret that does not exist in the same namespace?

Accepted Answer

The Pod remains in Pending state and fails to start

Answer

The Pod starts but the environment variable is set to an empty string

Answer

The Pod starts and the missing Secret key is skipped

Answer

Kubernetes automatically creates an empty Secret with that name

Question 7

How do you use a Secret to pull images from a private container registry in a Pod spec?

Accepted Answer

Specify the Secret name under the 'imagePullSecrets' field in the Pod spec

Answer

Mount the Secret as a volume at /root/.docker/config.json

Answer

Reference the Secret using envFrom with type=dockerconfigjson

Answer

Annotate the Pod with 'kubernetes.io/registry-secret: <name>'