How would you answer an interview scenario involving Kubernetes ConfigMaps and Secrets?

An application currently stores database passwords in deployment YAML. Explain how you would redesign secret storage and access.