hardMultiple ChoiceObjective-mapped
200-901 Practice Question: An application running in a Kubernetes pod needs…
An application running in a Kubernetes pod needs to access an external database securely. The database credentials are rotated every 24 hours. Which approach ensures that the pod always uses the current credentials without manual intervention?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a Secrets Store CSI driver to mount secrets from an external vault as a volume.
A Secrets Store CSI driver can dynamically mount secrets from an external vault as a volume, and the application can read the updated secret from the volume without restarting the pod, handling credential rotation seamlessly. Option A is incorrect because embedding a token in code is insecure and not automatically refreshed. Option C is incorrect because restarting the pod daily is disruptive and may cause downtime. Option D is incorrect because a sidecar container that watches a vault and updates config is less integrated and not a native Kubernetes approach compared to the CSI driver.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Embed a token in the application code that refreshes automatically.
Why it's wrong here
Not a standard Kubernetes approach.
- ✓
Use a Secrets Store CSI driver to mount secrets from an external vault as a volume.
Why this is correct
Dynamically updates secrets without pod restart.
- ✗
Store credentials in a Kubernetes Secret and mount as volume; restart pod daily.
Why it's wrong here
Requires pod restart and is disruptive.
- ✗
Use a sidecar container that watches a vault and updates the application config.
Why it's wrong here
Possible but less standard than CSI driver.
Go deeper
Related to this question
About these practice questions
One of 989 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.