McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 38

Question 370

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An existing ConfigMap dispatch-config in namespace fulfillment must supply environment variables to Deployment dispatch-api. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A successful API mutation does not guarantee updated Pods are healthy and available; rollout status tracks controller progress.
  2. Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes.
  3. Pod templates can reference Secret keys without copying literal secret values into the Deployment spec.
  4. Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.

Explanation

Correct Answer

B:

Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment set env deployment/dispatch-api --from=configmap/dispatch-config. The direct acceptance evidence is: Run kubectl -n fulfillment describe deployment dispatch-api and inspect the environment references on newly created Pods.

Incorrect Answers

A:

The offered statement is true for this other mechanism: A successful API mutation does not guarantee updated Pods are healthy and available; rollout status tracks controller progress. It does not explain the facts described here, which follow from: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes.

C:

Pod templates can reference Secret keys without copying literal secret values into the Deployment spec. That explanation applies to a different technical failure. Here the controlling principle is: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes.

D:

The offered statement is true for this other mechanism: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. It does not explain the facts described here, which follow from: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes.

Question 371

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An existing ConfigMap dispatch-config in namespace fulfillment must supply environment variables to Deployment dispatch-api. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n fulfillment get deployment dispatch-api and confirm updated and available replicas match the desired count.
  2. Run kubectl -n fulfillment get configmap dispatch-config -o jsonpath='{.data.MODE}' and confirm the declared value.
  3. Run kubectl -n fulfillment describe deployment dispatch-api and inspect the environment references on newly created Pods.
  4. Run kubectl -n observability rollout status deployment/metrics-api and kubectl -n observability get deployment metrics-api to compare desired and ready counts.

Explanation

Correct Answer

C:

Run kubectl -n fulfillment describe deployment dispatch-api and inspect the environment references on newly created Pods. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes. The intended action is: Run kubectl -n fulfillment set env deployment/dispatch-api --from=configmap/dispatch-config.

Incorrect Answers

A:

This observation would test a different technical dependency: A successful API mutation does not guarantee updated Pods are healthy and available; rollout status tracks controller progress. The current issue is governed by: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes. Its decisive check is “Run kubectl -n fulfillment describe deployment dispatch-api and inspect the environment references on newly created Pods”.

B:

The alternative verifies a different condition: ConfigMaps hold ordinary configuration data; their existence does not automatically inject values into running Pods. The current case instead depends on: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes. Confirm that “Run kubectl -n fulfillment describe deployment dispatch-api and inspect the environment references on newly created Pods”.

D:

This observation would test a different technical dependency: Scaling the Deployment changes desired replica count through its controller; editing an individual Pod would not preserve the desired state. The current issue is governed by: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes. Its decisive check is “Run kubectl -n fulfillment describe deployment dispatch-api and inspect the environment references on newly created Pods”.

Question 372

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An existing ConfigMap dispatch-config in namespace fulfillment must supply environment variables to Deployment dispatch-api. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Gate deployment promotion on observed rollout and readiness rather than API command exit alone.
  2. Record resume ownership and inspect currently active Jobs during planned suspensions.
  3. Version nonsecret application settings and avoid putting credentials into ConfigMaps.
  4. Track whether consumers use environment variables or mounted files when planning ConfigMap refreshes.

Explanation

Correct Answer

D:

Track whether consumers use environment variables or mounted files when planning ConfigMap refreshes. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment set env deployment/dispatch-api --from=configmap/dispatch-config. The relevant mechanism is: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes.

Incorrect Answers

A:

The suggested review tracks a different technical risk: A successful API mutation does not guarantee updated Pods are healthy and available; rollout status tracks controller progress. Here the sustained control must address: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes. Choose “Track whether consumers use environment variables or mounted files when planning ConfigMap refreshes”.

B:

That safeguard is relevant to: CronJob suspension prevents new scheduled Jobs but does not terminate existing Jobs already running. The current failure instead follows from: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes. Its prevention measure is “Track whether consumers use environment variables or mounted files when planning ConfigMap refreshes”.

C:

This routine guards against another mechanism: ConfigMaps hold ordinary configuration data; their existence does not automatically inject values into running Pods. The recurring exposure in the current case is: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes. The matching preventive check is “Track whether consumers use environment variables or mounted files when planning ConfigMap refreshes”.

Question 373

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: A lab application in ledger needs a disposable Secret lab-api-key with test key TOKEN set to dummy-demo-one; no real credentials may appear in examples. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger patch deployment invoice-api --type=merge -p '{"spec":{"template":{"spec":{"tolerations":[{"key":"special","operator":"Equal","value":"dedicated","effect":"NoSchedule"}]}}}}' after checking existing tolerations.
  2. Run kubectl -n ledger create secret generic lab-api-key --from-literal=TOKEN=dummy-demo-one for this disposable lab only.
  3. Run kubectl -n fulfillment patch deployment dispatch-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'.
  4. Run kubectl -n observability patch deployment metrics-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'.

Explanation

Correct Answer

B:

Run kubectl -n ledger create secret generic lab-api-key --from-literal=TOKEN=dummy-demo-one for this disposable lab only. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. Validate the result with: Run kubectl -n ledger get secret lab-api-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: A toleration allows a Pod past a matching taint but does not ensure placement without node selection and capacity. The case facts point instead to: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. Implement “Run kubectl -n ledger create secret generic lab-api-key --from-literal=TOKEN=dummy-demo-one for this disposable lab only” to address that specific condition.

C:

The proposed action belongs to the mechanism: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Here the stated fault follows a different mechanism: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The corrective choice is “Run kubectl -n ledger create secret generic lab-api-key --from-literal=TOKEN=dummy-demo-one for this disposable lab only”.

D:

The offered action targets: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The case facts point instead to: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. Implement “Run kubectl -n ledger create secret generic lab-api-key --from-literal=TOKEN=dummy-demo-one for this disposable lab only” to address that specific condition.

Question 374

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: A lab application in ledger needs a disposable Secret lab-api-key with test key TOKEN set to dummy-demo-one; no real credentials may appear in examples. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. CronJob suspension prevents new scheduled Jobs but does not terminate existing Jobs already running.
  2. Pod templates can reference Secret keys without copying literal secret values into the Deployment spec.
  3. Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation.
  4. A successful API mutation does not guarantee updated Pods are healthy and available; rollout status tracks controller progress.

Explanation

Correct Answer

C:

Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. This explains the stated condition. The corresponding action is: Run kubectl -n ledger create secret generic lab-api-key --from-literal=TOKEN=dummy-demo-one for this disposable lab only. The direct acceptance evidence is: Run kubectl -n ledger get secret lab-api-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token.

Incorrect Answers

A:

This principle describes a separate cause: CronJob suspension prevents new scheduled Jobs but does not terminate existing Jobs already running. The reported condition is governed by: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The two mechanisms should not be conflated.

B:

Pod templates can reference Secret keys without copying literal secret values into the Deployment spec. That explanation applies to a different technical failure. Here the controlling principle is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation.

D:

This principle describes a separate cause: A successful API mutation does not guarantee updated Pods are healthy and available; rollout status tracks controller progress. The reported condition is governed by: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The two mechanisms should not be conflated.

Question 375

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: A lab application in ledger needs a disposable Secret lab-api-key with test key TOKEN set to dummy-demo-one; no real credentials may appear in examples. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n ledger get deployment invoice-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements.
  2. Run kubectl -n ledger rollout status deployment/invoice-api and inspect the container image in the Deployment spec.
  3. Run kubectl -n observability get deployment metrics-api -o yaml and inspect spec.template.spec.tolerations before testing scheduling.
  4. Run kubectl -n ledger get secret lab-api-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token.

Explanation

Correct Answer

D:

Run kubectl -n ledger get secret lab-api-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The intended action is: Run kubectl -n ledger create secret generic lab-api-key --from-literal=TOKEN=dummy-demo-one for this disposable lab only.

Incorrect Answers

A:

The alternative verifies a different condition: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The current case instead depends on: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. Confirm that “Run kubectl -n ledger get secret lab-api-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token”.

B:

That test belongs to another control with this basis: Updating a Deployment Pod template triggers a controlled rollout; restarting Pods alone will not change the image reference. In the current case, the governing reason is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The direct verification is “Run kubectl -n ledger get secret lab-api-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token”.

C:

This observation would test a different technical dependency: A toleration allows a Pod past a matching taint but does not ensure placement without node selection and capacity. The current issue is governed by: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. Its decisive check is “Run kubectl -n ledger get secret lab-api-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token”.

Question 376

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: A lab application in ledger needs a disposable Secret lab-api-key with test key TOKEN set to dummy-demo-one; no real credentials may appear in examples. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. For production use protected secret-delivery workflows, RBAC and encryption-at-rest controls.
  2. Keep secret values out of logs and plan rollouts when Secret-backed environment variables change.
  3. Record resume ownership and inspect currently active Jobs during planned suspensions.
  4. Track HPA metric availability and avoid simultaneous manual scaling policies that fight the controller.

Explanation

Correct Answer

A:

For production use protected secret-delivery workflows, RBAC and encryption-at-rest controls. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger create secret generic lab-api-key --from-literal=TOKEN=dummy-demo-one for this disposable lab only. The relevant mechanism is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation.

Incorrect Answers

B:

This routine guards against another mechanism: Pod templates can reference Secret keys without copying literal secret values into the Deployment spec. The recurring exposure in the current case is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The matching preventive check is “For production use protected secret-delivery workflows, RBAC and encryption-at-rest controls”.

C:

The suggested review tracks a different technical risk: CronJob suspension prevents new scheduled Jobs but does not terminate existing Jobs already running. Here the sustained control must address: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. Choose “For production use protected secret-delivery workflows, RBAC and encryption-at-rest controls”.

D:

That safeguard is relevant to: HPA evaluates metrics relative to Pod resource requests; missing metrics or requests can leave desired replicas unknown. The current failure instead follows from: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. Its prevention measure is “For production use protected secret-delivery workflows, RBAC and encryption-at-rest controls”.

Question 377

At Horizon observability, in a disposable simulated environment during a monitored release window: A lab application in observability needs a disposable Secret lab-metrics-key with test key TOKEN set to dummy-demo-two; no real credentials may appear in examples. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability patch deployment metrics-api --type=merge -p '{"spec":{"strategy":{"type":"RollingUpdate","rollingUpdate":{"maxUnavailable":0,"maxSurge":1}}}}'.
  2. Run kubectl -n fulfillment patch deployment dispatch-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'.
  3. Run kubectl -n observability create secret generic lab-metrics-key --from-literal=TOKEN=dummy-demo-two for this disposable lab only.
  4. Run kubectl -n observability rollout status deployment/metrics-api --timeout=120s.

Explanation

Correct Answer

C:

Run kubectl -n observability create secret generic lab-metrics-key --from-literal=TOKEN=dummy-demo-two for this disposable lab only. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. Validate the result with: Run kubectl -n observability get secret lab-metrics-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

This alternative is a response to another technical cause: Deployment rolling-update parameters govern how many old Pods may be unavailable and extra Pods may be created during replacement. The reported case instead depends on: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The action that directly addresses it is “Run kubectl -n observability create secret generic lab-metrics-key --from-literal=TOKEN=dummy-demo-two for this disposable lab only”.

B:

The proposed action belongs to the mechanism: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Here the stated fault follows a different mechanism: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The corrective choice is “Run kubectl -n observability create secret generic lab-metrics-key --from-literal=TOKEN=dummy-demo-two for this disposable lab only”.

D:

This alternative is a response to another technical cause: A successful API mutation does not guarantee updated Pods are healthy and available; rollout status tracks controller progress. The reported case instead depends on: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The action that directly addresses it is “Run kubectl -n observability create secret generic lab-metrics-key --from-literal=TOKEN=dummy-demo-two for this disposable lab only”.

Question 378

At Horizon observability, in a disposable simulated environment during a monitored release window: A lab application in observability needs a disposable Secret lab-metrics-key with test key TOKEN set to dummy-demo-two; no real credentials may appear in examples. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. ConfigMaps hold ordinary configuration data; their existence does not automatically inject values into running Pods.
  2. A toleration allows a Pod past a matching taint but does not ensure placement without node selection and capacity.
  3. A successful API mutation does not guarantee updated Pods are healthy and available; rollout status tracks controller progress.
  4. Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation.

Explanation

Correct Answer

D:

Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. This explains the stated condition. The corresponding action is: Run kubectl -n observability create secret generic lab-metrics-key --from-literal=TOKEN=dummy-demo-two for this disposable lab only. The direct acceptance evidence is: Run kubectl -n observability get secret lab-metrics-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token.

Incorrect Answers

A:

ConfigMaps hold ordinary configuration data; their existence does not automatically inject values into running Pods. That explanation applies to a different technical failure. Here the controlling principle is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation.

B:

The offered statement is true for this other mechanism: A toleration allows a Pod past a matching taint but does not ensure placement without node selection and capacity. It does not explain the facts described here, which follow from: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation.

C:

This principle describes a separate cause: A successful API mutation does not guarantee updated Pods are healthy and available; rollout status tracks controller progress. The reported condition is governed by: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The two mechanisms should not be conflated.

Question 379

At Horizon observability, in a disposable simulated environment during a monitored release window: A lab application in observability needs a disposable Secret lab-metrics-key with test key TOKEN set to dummy-demo-two; no real credentials may appear in examples. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability get secret lab-metrics-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token.
  2. Run kubectl -n observability get deployment metrics-api -o yaml and inspect spec.template.spec.tolerations before testing scheduling.
  3. Run kubectl -n observability rollout status deployment/metrics-api and kubectl -n observability get deployment metrics-api to compare desired and ready counts.
  4. Run kubectl -n observability get deployment metrics-api -o yaml and inspect resource requests and limits for each container.

Explanation

Correct Answer

A:

Run kubectl -n observability get secret lab-metrics-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The intended action is: Run kubectl -n observability create secret generic lab-metrics-key --from-literal=TOKEN=dummy-demo-two for this disposable lab only.

Incorrect Answers

B:

This observation would test a different technical dependency: A toleration allows a Pod past a matching taint but does not ensure placement without node selection and capacity. The current issue is governed by: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. Its decisive check is “Run kubectl -n observability get secret lab-metrics-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token”.

C:

The alternative verifies a different condition: Scaling the Deployment changes desired replica count through its controller; editing an individual Pod would not preserve the desired state. The current case instead depends on: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. Confirm that “Run kubectl -n observability get secret lab-metrics-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token”.

D:

That test belongs to another control with this basis: Requests inform scheduling and limits cap runtime consumption; the settings play different roles. In the current case, the governing reason is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The direct verification is “Run kubectl -n observability get secret lab-metrics-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token”.

Question 380

At Horizon observability, in a disposable simulated environment during a monitored release window: A lab application in observability needs a disposable Secret lab-metrics-key with test key TOKEN set to dummy-demo-two; no real credentials may appear in examples. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Record resume ownership and inspect currently active Jobs during planned suspensions.
  2. For production use protected secret-delivery workflows, RBAC and encryption-at-rest controls.
  3. Treat taints and tolerations as paired scheduling controls and review preexisting tolerations when patching arrays.
  4. Retain meaningful revisions and perform health checks after every rollback.

Explanation

Correct Answer

B:

For production use protected secret-delivery workflows, RBAC and encryption-at-rest controls. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability create secret generic lab-metrics-key --from-literal=TOKEN=dummy-demo-two for this disposable lab only. The relevant mechanism is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation.

Incorrect Answers

A:

This routine guards against another mechanism: CronJob suspension prevents new scheduled Jobs but does not terminate existing Jobs already running. The recurring exposure in the current case is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The matching preventive check is “For production use protected secret-delivery workflows, RBAC and encryption-at-rest controls”.

C:

That safeguard is relevant to: A toleration allows a Pod past a matching taint but does not ensure placement without node selection and capacity. The current failure instead follows from: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. Its prevention measure is “For production use protected secret-delivery workflows, RBAC and encryption-at-rest controls”.

D:

This routine guards against another mechanism: A Deployment tracks ReplicaSet revisions and rollout undo restores a recorded earlier Pod template. The recurring exposure in the current case is: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The matching preventive check is “For production use protected secret-delivery workflows, RBAC and encryption-at-rest controls”.