200-901 Application Deployment and Security Practice Question
A security team requires that a web application's API calls to an internal service use mutual TLS. The application runs in a Kubernetes pod and the team wants the certificate and private key mounted as files without embedding them in the container image. Which Kubernetes resource should be used to provide the certificate and key to the pod?
⚠ Common exam trap
The trap here is treating ConfigMaps and Secrets as interchangeable because both can be mounted as files, when only Secrets are intended for confidential key material.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Secret of type kubernetes.io/tls mounted as a volume
Kubernetes Secrets are designed for sensitive data and the kubernetes.io/tls type specifically holds a certificate and key. Mounting the Secret as a volume projects the data into files inside the pod, allowing the application to load them for mutual TLS without baking credentials into the image. This satisfies both the security and file-mount requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A ConfigMap containing the certificate and key in data fields
Why it's wrong here
ConfigMaps are intended for non-confidential configuration data and are stored unencrypted by default in etcd. Placing a private key in a ConfigMap exposes it to anyone with read access to ConfigMaps in the namespace and violates the requirement to protect sensitive material. While it can be mounted as files, it is the wrong resource for cryptographic keys.
- ✗
An environment variable defined in the pod spec referencing a Secret
Why it's wrong here
Environment variables can expose secrets through process listings, crash dumps, and child processes, and they cannot easily represent multi-line PEM files. The scenario explicitly requires the certificate and key to be mounted as files, so environment variable injection does not satisfy the requirement even if backed by a Secret.
- ✓
A Secret of type kubernetes.io/tls mounted as a volume
Why this is correct
A Secret of type kubernetes.io/tls stores a TLS certificate and private key and can be mounted as files into a pod via a volume. This keeps sensitive material out of the image and allows the application to read the files at a known path for mutual TLS. Other resources either store non-sensitive data or do not provide file-based injection.
- ✗
A PersistentVolumeClaim bound to a network file share
Why it's wrong here
A PersistentVolumeClaim provides durable storage but does not manage secret material, access control, or rotation. Storing a private key on a shared volume increases the attack surface and requires separate provisioning, and it does not integrate with Kubernetes secret handling. It fails to meet the security and lifecycle requirements for TLS credentials.
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 975-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.