Test yourself
Kustomize
Final exam · 14 questions · answers explained as you pick
Beginner
4 questions
01Kustomize customizes Kubernetes YAML by…
Incorrect — the opposite — it is template-free.
Correct — no {{ }}; your YAML stays applicable as-is.
Incorrect — no code — declarative YAML.
Incorrect — unrelated.
02Kustomize is built into…
Incorrect — no.
Incorrect — no.
Correct — basic use needs nothing extra installed.
Incorrect — no.
03kustomize build outputs…
Correct — render → review → apply; kubectl -k does build+apply.
Incorrect — no.
Incorrect — no.
Incorrect — Kustomize has no state file.
04A ConfigMap/Secret generator appends a content hash to the name so that…
Incorrect — the reason is functional, not cosmetic.
Correct — solves the “ConfigMap changed but pods kept stale config” problem.
Incorrect — it does not encrypt — base64 only.
Incorrect — no.
4 questions · explanations appear as you answer
Intermediate
5 questions
01A base-and-overlay structure means…
Incorrect — the opposite — the base is shared.
Incorrect — no — the base is env-agnostic; overlays hold differences.
Correct — shared config lives once; edit the base and all overlays inherit it.
Incorrect — no.
02A JSON6902 patch is preferable to strategic-merge when you need to…
Correct — precise op-based edits (add/replace/remove at a path).
Incorrect — strategic-merge is nicer for that.
Incorrect — unrelated.
Incorrect — that is a generator, not a patch.
03The images transformer with digest: sha256:… gives you…
Incorrect — digest does not change size.
Correct — promote the exact artifact tested in staging into prod.
Incorrect — not the point.
Incorrect — no.
04A strategic-merge patch whose target does not match any resource…
Incorrect — not always — it can be silently skipped.
Incorrect — unrelated.
Correct — confirm the patch took effect in the rendered output.
Incorrect — no.
05A Kustomize component is…
Correct — feature toggles via composition (monitoring, network-policy, hardening).
Incorrect — that is a base; components are opt-in.
Incorrect — no.
Incorrect — no.
5 questions · explanations appear as you answer
Advanced
5 questions
01A Kustomize secretGenerator protects secret values by…
Incorrect — no — it only base64-encodes.
Incorrect — no.
Correct — base64 is encoding, not encryption; keep sources out of Git.
Incorrect — only if you wire ESO/CSI — not by default.
02A remote base should be referenced with…
Incorrect — a moving branch is untrusted live code in your cluster.
Correct — pin it like any dependency; the build output is code you run.
Incorrect — that pulls whatever the default branch is today.
Incorrect — no.
03A good rule for Helm vs Kustomize is…
Correct — and you can combine them (helmCharts + patches).
Incorrect — not for simple template-free overlays.
Incorrect — not for distributable, logic-heavy packages.
Incorrect — no.
04In GitOps, the key security habit for Kustomize is…
Incorrect — a small diff can hide big changes in the assembled output.
Correct — the rendered result is what runs — gate on it, not just the overlay.
Incorrect — over-privileged.
Incorrect — never — use SOPS/ESO.
05Piping kustomize build of a secret-bearing overlay into a CI log…
Incorrect — generated Secrets are base64, not encrypted.
Incorrect — no.
Correct — keep secret-bearing output out of logs/artifacts.
Incorrect — no.
5 questions · explanations appear as you answer