CKAD Configuration and Secrets 3

Question 1

How do you reference a specific key from a ConfigMap as an environment variable named 'DB_HOST' in a container?

Accepted Answer

env: [{name: DB_HOST, valueFrom: {configMapKeyRef: {name: mycm, key: db_host}}}]

Answer

Use 'env[].valueFrom.configMapKeyRef' with 'name' (ConfigMap name) and 'key' (the key to reference) to inject a specific value.

Question 2

Which 'kubectl create secret' subcommand creates a TLS secret from a certificate and key file?

Accepted Answer

kubectl create secret tls my-tls --cert=tls.crt --key=tls.key

Answer

'kubectl create secret tls' with '--cert' and '--key' creates a 'kubernetes.io/tls' typed Secret for TLS termination.

Question 3

What is the purpose of 'ResourceQuota' in a Kubernetes namespace?

Accepted Answer

Limits total resource consumption and object counts within a namespace

Answer

ResourceQuota enforces aggregate limits on total CPU, memory, storage, and Kubernetes object counts for a namespace.

Question 4

Which security context field grants a container specific Linux capabilities without running as root?

Accepted Answer

securityContext.capabilities.add

Answer

'capabilities.add' in the container's securityContext grants specific Linux capabilities (e.g., NET_ADMIN) without full root privileges.

Question 5

How do you update a ConfigMap value and automatically reflect it in a pod using a mounted volume?

Accepted Answer

The mounted ConfigMap volume updates automatically after a short sync period

Answer

ConfigMaps mounted as volumes are refreshed by the kubelet automatically (within the kubelet sync period), unlike environment variable injections.

CKAD - Certified Kubernetes Application Developer Practice Test