nerdexam
Docker

DCA · Question #40

A service 'wordpress' is running using a password string to connect to a non-Dockerized database service. The password string is passed into the 'wordpress' service as a Docker secret. Per security…

The correct answer is D. Create a new docker secret with a new password. To initiate the rotation of a Docker secret, the first step is to create a new Docker secret containing the updated password.

Submitted by kavita_s· Apr 18, 2026Security

Question

A service 'wordpress' is running using a password string to connect to a non-Dockerized database service. The password string is passed into the 'wordpress' service as a Docker secret. Per security policy, the password on the database was changed. Identity the correct sequence of steps to rotate the secret from the old password to the new password.

Options

  • ACreate a new docker secret with the new password.
  • BTrigger an update to the service by using 'docker service update --secret=<new password>'
  • CCreate a new docker secret with the new password.
  • DCreate a new docker secret with a new password.

How the community answered

(46 responses)
  • A
    2% (1)
  • B
    7% (3)
  • C
    4% (2)
  • D
    87% (40)

Why each option

To initiate the rotation of a Docker secret, the first step is to create a new Docker secret containing the updated password.

ACreate a new docker secret with the new password.

This option is identical to the correct answer, indicating a potential flaw in the question's design or an emphasis on this specific first step.

BTrigger an update to the service by using 'docker service update --secret=<new password>'

Triggering an update with `docker service update --secret=<new password>` is not the correct syntax for updating secrets, and the new secret must first exist.

CCreate a new docker secret with the new password.

This option is identical to the correct answer, indicating a potential flaw in the question's design or an emphasis on this specific first step.

DCreate a new docker secret with a new password.Correct

When rotating a Docker secret, the best practice involves a multi-step process where the initial and crucial step is to create a *new* secret with the updated sensitive information. This new secret will then be referenced by the service, allowing for a smooth transition without service disruption before the old secret is eventually removed.

Concept tested: Docker Secrets rotation process

Source: https://docs.docker.com/engine/reference/commandline/secret_create/

Topics

#Docker Secrets#Secret Rotation#Service Management#Security Policy

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DCA Practice