200-901 Application Deployment and Security Practice Question
A Kubernetes cluster runs a microservice that needs to read configuration values from a ConfigMap and sensitive database credentials from a Secret. The pod manifest references both resources. How should the Secret be mounted to avoid exposing sensitive data in logs or environment variables?
⚠ Common exam trap
Cisco often tests the distinction between environment variable injection and volume mounts for Secrets, trapping candidates who assume envFrom is secure because it avoids file I/O, when in fact it exposes secrets to logging and debugging tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using a volume mount with a secret volume
Mounting a Secret as a volume stores the data in the tmpfs (RAM-backed filesystem) of the pod, which is not written to disk and is not exposed via environment variables that could be logged or printed by the application. This approach prevents accidental leakage of sensitive data through log outputs or environment variable dumps, as the application must explicitly read the file from the mount point.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcoding the credentials in the ConfigMap
Why it's wrong here
Incorrect. ConfigMap is for non-sensitive data; hardcoding is a bad practice.
- ✗
Using a sidecar container to fetch secrets via API
Why it's wrong here
Incorrect. This is complex and still may expose via env if not careful.
- ✗
Using envFrom with secretRef
Why it's wrong here
Incorrect. Environment variables can leak in logs or process listings.
- ✓
Using a volume mount with a secret volume
Why this is correct
Correct. Mounting as files avoids exposing values in environment.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.