$ sops --version
sops 3.11.0

$ sops decrypt --extract '["stringData"]["DB_PASSWORD"]' secrets/app.enc.yaml
super-secret-password-value

$ sops decrypt secrets/app.enc.yaml
Failed to get the data key required to decrypt the SOPS file.