Interview kitsBlog

Your dream job? Lets Git IT.
Interactive technical interview preparation platform designed for modern developers.

XGitHub

Platform

  • Categories

Resources

  • Blog
  • About the app
  • FAQ
  • Feedback

Legal

  • Privacy Policy
  • Terms of Service

© 2026 LetsGit.IT. All rights reserved.

LetsGit.IT/Categories/DevOps
DevOpseasy

Configuration vs secrets — how should you manage them in DevOps?

Tags
#secrets#config#security
Back to categoryPractice quiz

Answer

Configuration is non-sensitive and can be versioned. Secrets should live in a secret manager/KMS, be injected at runtime, rotated, and accessed with least privilege.

Advanced answer

Deep dive

Expanding on the short answer — what usually matters in practice:

  • Context (tags): secrets, config, security
  • Reliability: detect issues (monitoring) and limit blast radius (rollback, feature flags).
  • Security: least privilege, secret rotation, supply chain.
  • Automation: idempotency, repeatability, drift control.
  • Explain the "why", not just the "what" (intuition + consequences).
  • Trade-offs: what you gain/lose (time, memory, complexity, risk).
  • Edge cases: empty inputs, large inputs, invalid inputs, concurrency.

Examples

A tiny example (an explanation template):

// Example: discuss trade-offs for "configuration-vs-secrets-—-how-should-you-manage"
function explain() {
  // Start from the core idea:
  // Configuration is non-sensitive and can be versioned. Secrets should live in a secret manag
}

Common pitfalls

  • Too generic: no concrete trade-offs or examples.
  • Mixing average-case and worst-case (e.g., complexity).
  • Ignoring constraints: memory, concurrency, network/disk costs.

Interview follow-ups

  • When would you choose an alternative and why?
  • What production issues show up and how do you diagnose them?
  • How would you test edge cases?

Related questions

DevOps
What are best practices for secure and small Docker images?
#docker#containers#security
Security
How do you manage secrets in CI/CD and production?
#secrets#ci-cd#vault
Security
How should passwords be stored securely?
#passwords
#hashing
#security
Security
Authentication vs authorization — what’s the difference, with examples?
#authn#authz#security
Security
What is threat modeling, and how do you run a lightweight threat model for a feature?
#threat-modeling#risk#security