Module Quiz

Question 1

Why should secrets never be passed as literal values into an agent's context window?

Select all that apply

The model may echo the value in its response or explanation

Kubernetes cannot mount secrets that originate from an LLM context

The value can be captured in orchestration or MCP server logs

LLMs automatically redact base64-encoded strings from all outputs

Question 2

Which image reference format correctly pins a container image to an immutable digest?

Select one answer

ghcr.io/your-org/api:latest

ghcr.io/your-org/api:v1.4

ghcr.io/your-org/api@sha256:a3f2c1d4e5b6...

ghcr.io/your-org/api:stable

Question 3

What is the primary purpose of separating a pipeline into a read identity and a write identity?

Select one answer

To comply with Kubernetes RBAC naming conventions

To limit the blast radius when an agent behaves unexpectedly, so context gathering and cluster modification are gated separately

To allow the agent to bypass admission controllers for read operations

To enable the agent to cache cluster state in a local database

Question 4

Which kubectl command issues a time-bounded service account token valid for 15 minutes?

Type your answer below