Quiz Module 5 - Configuration and Secrets

Instructions

This quiz contains 30 multiple-choice questions.

---

Question 1

What is a ConfigMap?

1. A Kubernetes object that stores non-sensitive configuration data

2. A type of volume

3. A network service

Show explanation

Correct answer: A Kubernetes object that stores non-sensitive configuration data

Explanation: ConfigMaps allow you to separate configuration from application code.

---

Question 2

What is a Secret in Kubernetes?

1. A type of ConfigMap

2. A Kubernetes object that stores sensitive data such as passwords, tokens, or keys

3. A type of volume

4. A network service

Show explanation

Correct answer: A Kubernetes object that stores sensitive data such as passwords, tokens, or keys

Explanation: Secrets are similar to ConfigMaps but are designed to store sensitive data. They are stored in base64 (not encrypted by default).

---

Question 3

How do you create a ConfigMap from a file?

1. kubectl create configmap --from-file

2. kubectl create configmap [name] --from-file=[file]

3. kubectl apply configmap --file

4. kubectl new configmap --file

Show explanation

Correct answer: kubectl create configmap [name] --from-file=[file]

Explanation: The --from-file flag allows you to create a ConfigMap from a file, where the key is the filename and the value is the file content.

---

Question 4

What is the maximum size of an entry in a ConfigMap?

1. 100 KiB

2. 1 MiB

3. 10 MiB

4. 100 MiB

Show explanation

Correct answer: 1 MiB

Explanation: Each entry in a ConfigMap or Secret is limited to 1 MiB. For larger data, use volumes.

---

Question 5

How do you inject a ConfigMap as environment variables in a Pod?

1. env: configMapRef

2. envFrom: - configMapRef: name: [configmap-name]

3. volumeMounts: configMap

4. env: valueFrom: configMap

Show explanation

Correct answer: envFrom: - configMapRef: name: [configmap-name]

Explanation: envFrom allows you to inject all keys from a ConfigMap as environment variables. For a specific key, use env with valueFrom.configMapKeyRef.

---

Question 6

How do you mount a ConfigMap as a volume in a Pod?

1. env: volume: configMap

2. volumes: - name: config configMap: name: [configmap-name]

3. volumeMounts: configMap

4. mount: configMap

Show explanation

Correct answer: volumes: - name: config configMap: name: [configmap-name]

Explanation: To mount a ConfigMap as a volume, define it in the Pod's volumes section, then use volumeMounts to mount it in the container.

---

Question 7

What is the main difference between a ConfigMap and a Secret?

1. No difference

2. Secrets are designed for sensitive data and stored in base64, ConfigMaps are for non-sensitive data

3. ConfigMaps are more secure

4. Secrets cannot be mounted as volumes

Show explanation

Correct answer: Secrets are designed for sensitive data and stored in base64, ConfigMaps are for non-sensitive data

Explanation: Secrets are intended for sensitive data but are not encrypted by default (just base64-encoded). ConfigMaps are for non-sensitive data.

---

Question 8

How do you create a Secret from literals?

1. kubectl create secret --from-literal

2. kubectl create secret generic [name] --from-literal=[key]=[value]

3. kubectl apply secret --literal

4. kubectl new secret --literal

Show explanation

Correct answer: kubectl create secret generic [name] --from-literal=[key]=[value]

Explanation: --from-literal allows you to create a Secret directly from key-value pairs on the command line.

---

Question 9

What is the best practice for managing secrets in production?

1. Commit them to Git

2. Use external secret management tools (Vault, AWS Secrets Manager) with External Secrets Operator

3. Store them in plain text in YAML files

4. Share them via email

Show explanation

Correct answer: Use external secret management tools (Vault, AWS Secrets Manager) with External Secrets Operator

Explanation: Secrets should never be committed to Git. Use external tools like Vault or cloud services with External Secrets Operator for secure management.

---

Question 10

What is encryption at rest for Secrets?

1. Automatic encryption of Secrets in etcd

2. A feature that encrypts Secrets in etcd using an EncryptionConfig

3. Storing Secrets in base64

4. Volume encryption

Show explanation

Correct answer: A feature that encrypts Secrets in etcd using an EncryptionConfig

Explanation: Encryption at rest encrypts Secrets in etcd by configuring an EncryptionConfig with encryption providers (AES, KMS, etc.).

---

Question 11

Which command allows you to see the decoded content of a Secret?

1. kubectl get secret [name] -o yaml

2. kubectl get secret [name] -o jsonpath='{.data.[key]}' | base64 -d

3. kubectl describe secret [name]

4. kubectl show secret [name]

Show explanation

Correct answer: kubectl get secret [name] -o jsonpath='{.data.[key]}' | base64 -d

Explanation: Secrets are stored in base64. To see the decoded content, use jsonpath to extract the value and base64 -d to decode it.

---

Question 12

What is External Secrets Operator?

1. A type of Secret

2. A Kubernetes operator that syncs secrets from external systems (AWS Secrets Manager, Vault, etc.) to Kubernetes

3. A CNI plugin

4. A type of ConfigMap

Show explanation

Correct answer: A Kubernetes operator that syncs secrets from external systems (AWS Secrets Manager, Vault, etc.) to Kubernetes

Explanation: External Secrets Operator enables centralized secret management in external systems and automatically syncs them to Kubernetes.

---

Question 13

What is the recommended method for injecting a Secret into a Pod?

1. Hardcode in the code

2. Use envFrom with secretRef or env with valueFrom.secretKeyRef

3. Copy them manually

4. Pass them as arguments

Show explanation

Correct answer: Use envFrom with secretRef or env with valueFrom.secretKeyRef

Explanation: Secrets should be injected via envFrom (all keys) or env with valueFrom.secretKeyRef (a specific key), never hardcoded.

---

Question 14

What is the difference between env and envFrom?

1. No difference

2. env allows injecting individual variables, envFrom injects all keys from a ConfigMap/Secret

3. env is for Secrets, envFrom is for ConfigMaps

4. envFrom is deprecated

Show explanation

Correct answer: env allows injecting individual variables, envFrom injects all keys from a ConfigMap/Secret

Explanation: env provides precise control over each variable, while envFrom automatically injects all keys as environment variables.

---

Question 15

What is the best practice for permissions on a Secret volume?

1. 0777 (read, write, execute for all)

2. 0400 (read-only for the owner)

3. 0755 (read and execute for all)

4. 0600 (read and write for the owner)

Show explanation

Correct answer: 0400 (read-only for the owner)

Explanation: Secret volumes should be mounted as read-only (readOnly: true) with restrictive permissions (defaultMode: 0400) for security.

---

Question 16

What is an immutable ConfigMap?

1. A ConfigMap that cannot be read

2. A ConfigMap that cannot be modified after creation, improving performance and security

3. A deprecated ConfigMap

4. A ConfigMap that cannot be deleted

Show explanation

Correct answer: A ConfigMap that cannot be modified after creation, improving performance and security

Explanation: Immutable ConfigMaps (immutable: true) cannot be modified, reducing the load on the API Server and improving security.

---

Question 17

How do you update a ConfigMap used by a running Pod?

1. The ConfigMap updates automatically

2. If mounted as a volume, you need to restart the Pod. If injected as env, you need to recreate the Pod

3. The Pod updates automatically

4. Impossible to update

Show explanation

Correct answer: If mounted as a volume, you need to restart the Pod. If injected as env, you need to recreate the Pod

Explanation: ConfigMaps mounted as volumes are updated periodically, but injected environment variables do not change without recreating the Pod.

---

Question 18

What is the command to create a Secret from a file?

1. kubectl create secret --from-file

2. kubectl create secret generic [name] --from-file=[key]=[file]

3. kubectl apply secret --file

4. kubectl new secret --file

Show explanation

Correct answer: kubectl create secret generic [name] --from-file=[key]=[file]

Explanation: --from-file allows you to create a Secret from a file, where you can specify the key and the source file.

---

Question 19

What is secret rotation?

1. Deleting secrets

2. The process of periodically replacing secrets with new values for security

3. Copying secrets

4. Encrypting secrets

Show explanation

Correct answer: The process of periodically replacing secrets with new values for security

Explanation: Secret rotation is a security best practice that involves regularly changing passwords, tokens, and keys to limit the impact of a compromise.

---

Question 20

What is the difference between an Opaque Secret and a TLS Secret?

1. No difference

2. Opaque is for arbitrary data, TLS is specifically for TLS certificates

3. TLS is for arbitrary data

4. Opaque is deprecated

Show explanation

Correct answer: Opaque is for arbitrary data, TLS is specifically for TLS certificates

Explanation: TLS Secrets have specific keys (tls.crt, tls.key) and are used by tools like cert-manager for SSL/TLS certificates.

---

Question 21

How do you organize ConfigMaps by environment?

1. Use a single ConfigMap for all environments

2. Create separate ConfigMaps for each environment (dev, staging, prod) with different names

3. Use labels only

4. Use namespaces only

Show explanation

Correct answer: Create separate ConfigMaps for each environment (dev, staging, prod) with different names

Explanation: The best practice is to create distinct ConfigMaps for each environment, allowing clear management and avoiding configuration errors.

---

Question 22

What is the total size limit of a ConfigMap or Secret?

1. 1 MiB

2. Limited by etcd (typically 1.5 MiB per object)

3. 10 MiB

4. 100 MiB

Show explanation

Correct answer: Limited by etcd (typically 1.5 MiB per object)

Explanation: While each entry is limited to 1 MiB, the total size of a ConfigMap or Secret is limited by etcd, typically around 1.5 MiB.

---

Question 23

What is a Secret volume type?

1. A type of Secret

2. A volume that mounts Secret data as files in a Pod

3. An encrypted volume

4. A type of ConfigMap

Show explanation

Correct answer: A volume that mounts Secret data as files in a Pod

Explanation: Secrets can be mounted as volumes, where each key becomes a file with the decoded value as content.

---

Question 24

What is the best practice for secrets in YAML files?

1. Put them in plain text in YAML files

2. Never put secrets in plain text, use references (secretKeyRef) or external tools

3. Comment them in YAML files

4. Put them in base64 in YAML files

Show explanation

Correct answer: Never put secrets in plain text, use references (secretKeyRef) or external tools

Explanation: Secrets should never be in plain text in YAML files, even in base64. Use references or secret management tools.

---

Question 25

How do you use a ConfigMap in a Deployment?

1. Directly in the Deployment

2. In the Pod template of the Deployment, via env, envFrom, or volumes

3. In the annotations

4. In the labels

Show explanation

Correct answer: In the Pod template of the Deployment, via env, envFrom, or volumes

Explanation: ConfigMaps are referenced in the Pod template (spec.template.spec) of a Deployment, via env/envFrom for environment variables or volumes for files.

---

Question 26

What is a Service Account in the context of Secrets?

1. A type of Secret

2. An identity for Pods that can be associated with Secrets for API Server access

3. A user account

4. A type of ConfigMap

Show explanation

Correct answer: An identity for Pods that can be associated with Secrets for API Server access

Explanation: Service Accounts can have imagePullSecrets to access private registries, but are not directly related to application Secrets.

---

Question 27

What is the command to delete a ConfigMap?

1. kubectl remove configmap [name]

2. kubectl delete configmap [name]

3. kubectl rm configmap [name]

4. kubectl drop configmap [name]

Show explanation

Correct answer: kubectl delete configmap [name]

Explanation: kubectl delete is the standard command for deleting any Kubernetes resource, including ConfigMaps.

---

Question 28

What is a docker-registry Secret?

1. A Secret for Docker

2. A Secret that stores credentials for accessing a private Docker registry

3. A type of ConfigMap

4. A deprecated Secret

Show explanation

Correct answer: A Secret that stores credentials for accessing a private Docker registry

Explanation: docker-registry Secrets are used as imagePullSecrets to allow Pods to pull images from private registries.

---

Question 29

What is the best practice for versioning ConfigMaps?

1. Do not version

2. Use labels with version numbers and create new ConfigMaps for each version

3. Use annotations only

4. Modify the same ConfigMap

Show explanation

Correct answer: Use labels with version numbers and create new ConfigMaps for each version

Explanation: Versioning ConfigMaps with labels allows you to track changes and facilitates rollbacks by referencing different versions.

---

Question 30

What is the difference between valueFrom.configMapKeyRef and valueFrom.secretKeyRef?

1. No difference

2. configMapKeyRef references a key in a ConfigMap, secretKeyRef references a key in a Secret

3. secretKeyRef is for ConfigMaps

4. configMapKeyRef is deprecated

Show explanation

Correct answer: configMapKeyRef references a key in a ConfigMap, secretKeyRef references a key in a Secret

Explanation: These two references work the same way but point to different resource types: ConfigMap for non-sensitive data, Secret for sensitive data.

---

Quiz Results

Congratulations on completing the Module 5 quiz!

Score:

• 25-30 correct answers: Excellent! You have mastered configuration and secrets.
• 20-24 correct answers: Very good! Review concepts where you had difficulty.
• 15-19 correct answers: Good! Review the chapters on ConfigMaps and Secrets.
• Less than 15: Recommended to review the module before continuing.

---

Quiz created: December 2024