easyMultiple ChoiceObjective-mapped
200-901 Practice Question: A developer is deploying a containerized…
A developer is deploying a containerized application to a Kubernetes cluster. To ensure that the application can securely access a third-party API, what is the best practice for storing the API key?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store it as a Kubernetes Secret and mount it as an environment variable.
Kubernetes Secrets are designed for sensitive data and can be mounted as environment variables. Option B is insecure because hardcoding keys in images exposes them. Option C is incorrect because service account tokens are for cluster authentication, not external APIs. Option D is incorrect because ConfigMaps are for non-sensitive configuration data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store it as a Kubernetes Secret and mount it as an environment variable.
Why this is correct
Kubernetes Secrets are designed for sensitive data and can be mounted as environment variables.
- ✗
Hardcode the API key in the Docker image.
Why it's wrong here
Hardcoding keys in images exposes them to anyone with access to the image, which is insecure.
- ✗
Use a service account token.
Why it's wrong here
Service account tokens are used for Kubernetes API authentication, not for external API keys.
- ✗
Store it in a ConfigMap and reference it from the pod.
Why it's wrong here
ConfigMaps are for non-sensitive configuration data, not secrets like API keys.
Go deeper
Related to this question
About these practice questions
One of 989 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.