CKA ConfigMaps and Secrets 3

Question 1

Which Kubernetes resource type can be used to automatically mount a ServiceAccount token Secret into every Pod that uses that ServiceAccount?

Accepted Answer

ServiceAccount

Answer

ClusterRole

Answer

RoleBinding

Answer

SecretMount

Question 2

What field in a projected volume allows you to combine a ConfigMap and a Secret into a single volume mount path?

Accepted Answer

projected.sources

Answer

projected.configMaps

Answer

combined.volumes

Answer

multi.source

Question 3

What is the recommended way to enable encryption at rest for Secrets in Kubernetes?

Accepted Answer

Configure an EncryptionConfiguration file and reference it with --encryption-provider-config on the API server

Answer

Enable the --encrypt-secrets flag on the kube-controller-manager

Answer

Set the encryptionKey field in the Secret manifest before applying it

Answer

Install the cert-manager addon and annotate Secrets with encrypt=true

Question 4

An application Pod references a ConfigMap key that does not exist. The container spec uses 'configMapKeyRef' without any optional setting. What will happen?

Accepted Answer

The Pod will fail to start because the missing key causes an error

Answer

The environment variable will be set to an empty string

Answer

Kubernetes will create the missing key with an empty value

Answer

The Pod will start and the environment variable will be unset

Question 5

You want a container to receive an updated ConfigMap value without a Pod restart. Which mounting method supports this?

Accepted Answer

Mount the ConfigMap as a volume; the kubelet will periodically sync the files

Answer

Use envFrom; Kubernetes hot-reloads environment variables automatically

Answer

Use valueFrom.configMapKeyRef; the env var updates on ConfigMap change

Answer

Neither method supports live updates; a restart is always required

Question 6

Which command decodes the base64-encoded value of a key 'password' from a Secret named 'db-secret'?

Accepted Answer

kubectl get secret db-secret -o jsonpath='{.data.password}' | base64 --decode

Answer

kubectl describe secret db-secret --decode-key=password

Answer

kubectl get secret db-secret --plain-text

Answer

kubectl decode secret db-secret --key=password

Question 7

What is the effect of setting 'optional: true' on a configMapKeyRef or secretKeyRef in a container's env spec?

Accepted Answer

The Pod starts even if the referenced ConfigMap, Secret, or key does not exist

Answer

The referenced value is treated as optional only if the key exists but is empty

Answer

The Pod waits indefinitely until the ConfigMap or Secret is created

Answer

Kubernetes generates a default value of 'none' for the missing key