Course Test

Please answer the questions below to complete the test.

Question 1

An agent generates a Deployment manifest that includes a plaintext API key in an environment variable field. Which corrective pattern should you apply?

Select one answer

Base64-encode the API key before embedding it in the manifest

Replace the inline value with a secretKeyRef pointing to a Kubernetes Secret

Store the API key in a ConfigMap instead of the Deployment manifest

Pass the API key as a command-line argument to the container entrypoint

Question 2

Which of the following are valid reasons to use the External Secrets Operator (ESO) rather than native Kubernetes Secrets for agent credentials? Select all that apply.

Select all that apply

ESO enables automatic credential rotation by re-syncing from the external store on a configurable interval

ESO prevents the credential value from being stored in etcd

ESO removes the need for RBAC on Kubernetes Secrets

ESO automatically redacts secrets from kubectl describe output

Question 3

A Kyverno ClusterPolicy is configured to require images of the form '*@sha256:*'. What class of supply chain risk does this policy directly address?

Select one answer

Prompt injection attacks via malicious container entry points

Silent image substitution through mutable registry tags being overwritten after manifest authoring

Missing resource limits causing CPU starvation

Privilege escalation via RBAC misconfiguration

Question 4

You are designing the network policy for the namespace where a Meshery agent pod runs. What should the default stance be before adding specific allow rules?

Select one answer

Default allow all ingress, default deny all egress

Default allow all traffic and add deny rules for known-bad destinations

Default deny all ingress and egress, then add explicit allow rules for required connections only

No network policy is needed because the agent namespace is internal-only

Question 5

In a least-privilege pipeline model, which verbs should typically be ABSENT from the write service account's Role for a Meshery design applier? Select all that apply.

Select all that apply

delete

create

get on secrets

create on clusterrolebindings

Question 6

What Meshery CLI command verifies that the Meshery system is reachable and healthy after a credential rotation?

Type your answer below