CKA Storage Practice Question
Which of the following volume types is designed to store sensitive information such as passwords or tokens?
⚠ Common exam trap
A common pitfall in the CKA exam is confusing ConfigMap with Secret. Candidates often think ConfigMap can store sensitive data because it also holds key-value pairs, but ConfigMap lacks encryption and tmpfs mounting, which are essential for security. Secrets are specifically designed for sensitive information.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
secret
The Secret volume type is specifically designed to store sensitive data such as passwords, tokens, or SSH keys. Secrets are stored in the cluster's etcd (optionally encrypted at rest) and are injected into pods as files or environment variables, with in-memory (tmpfs) mounting to avoid writing sensitive data to disk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
emptyDir
Why it's wrong here
emptyDir is an ephemeral volume created when a pod is assigned to a node and exists only as long as that pod runs. It is intended for scratch space, caches, or sharing files between containers in the same pod, not for storing sensitive material. Its contents are deleted when the pod is removed, and there is no integration with secret rotation, RBAC, or encryption. Therefore, using emptyDir for passwords or tokens would violate the principle of managed secret delivery.
- ✗
hostPath
Why it's wrong here
hostPath mounts a designated file or directory from the node's filesystem into a pod. It bypasses Kubernetes API-level secret management, offers no encryption and no access control beyond the node's filesystem permissions, and exposes pods to node-local paths. hostPath is tied to a specific node and its lifecycle, making it unsuitable and unsafe for distributing credentials. A secret should be an API-declared object with access control and lifecycle management, not a host-dependent path.
- ✓
secret
Why this is correct
The Secret volume type is specifically designed to store and deliver sensitive data such as passwords, OAuth tokens, and SSH keys to containers. Secret objects are persisted in etcd, subject to RBAC authorization, and can be encrypted at rest via EncryptionConfiguration. When mounted as volumes, they are exposed as files in a tmpfs-backed directory rather than written to persistent disk, reducing data-loss exposure. This makes Secret the intended and secure choice for the 'sensitive data' scenario in the question.
- ✗
configMap
Why it's wrong here
ConfigMap is designed for non-sensitive configuration data, such as environment variables, command-line arguments, and small configuration files. It offers no built-in protection for confidential content, and its values are stored in plaintext in etcd unless you separately encrypt the underlying storage. ConfigMaps are meant to be readable by many workloads and lack encryption and access controls suited for secrets. Putting a secret in a ConfigMap would expose it to any user with read access to the ConfigMap object.
Go deeper
Related to this question
About these practice questions
This CKA question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.