All quizzesHard
Secrets & Hot Reload — Series 3
Preview — 3 of 10 questions
What has to happen?
javascript
The secret manager issues database credentials with a 1-hour lease.
The connection pool was built at startup with the first set.ANothing; existing connections keep working, so the lease is irrelevant
BThe application must restart hourly to pick up new credentials
CThe lease must be renewed before it expires and the pool must be able to use the new credentials for connections it opens afterwards — open connections usually survive, but every new one authenticates with whatever the pool was configured with, so a pool that captured the credentials once will start failing as it grows or recycles
DThe pool should be configured with max: 1 so only one connection is affected
What makes this safe?
javascript
An mTLS certificate expires in 30 days. It must be replaced with no dropped connections.AIssue the new certificate from the same CA and reload it before the old one expires, while both the old and the new CA certificates remain in every peer's trust store — established connections keep their negotiated session and new ones use the new certificate, so the change is invisible provided trust is widened before the leaf is swapped
BRestart every service simultaneously so nothing sees a mixed state
CExtend the existing certificate's validity in place
DDisable verification during the rotation window
How is this bootstrap problem usually resolved?
javascript
The application authenticates to the secret manager to fetch its secrets.
What authenticates it to the secret manager?AA long-lived token baked into the image, which is acceptable because it grants only read access
BA password shared by the team and entered at deploy time
CBy running the secret manager without authentication inside the private network
DBy delegating it to the platform: the workload receives an attested identity it never stores — a projected service-account token, an instance identity document, a cloud IAM role — which it exchanges for a short-lived credential, so there is no secret zero to protect because the platform vouches for the workload
Sign up free to play
Answer all 10 questions (7 more), see explanations for every answer, and track your score.