CKAD Practice Question: Application Environment, Configuration and Security
A developer needs to create a Secret named 'db-credentials' in the 'staging' namespace using the literal values username=admin and password=S3cr3t!. Which kubectl command will accomplish this?
⚠ Common exam trap
Many candidates confuse --from-literal with --from-file, or using a colon instead of an equals sign in the key-value pair.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl create secret generic db-credentials --from-literal=username=admin --from-literal=password=S3cr3t! -n staging
The kubectl create secret generic command with --from-literal is designed to create a Secret from literal key-value pairs. The -n flag specifies the namespace. The other options either use incorrect flags or syntax that does not match the intended use, such as --from-file requiring files or the tls type requiring certificates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl create secret tls db-credentials --from-literal=username=admin --from-literal=password=S3cr3t! -n staging
Why it's wrong here
The 'tls' secret type is specifically for TLS certificates and requires --cert and --key flags. It does not accept --from-literal for arbitrary keys. Using it here would result in an error because the required certificate files are missing. This command is meant for storing TLS key pairs, not generic credentials.
- ✗
kubectl create secret generic db-credentials --from-literal=username:admin --from-literal=password:S3cr3t! -n staging
Why it's wrong here
The --from-literal flag uses an equals sign (=) to separate the key and value, not a colon (:). Using a colon would cause kubectl to interpret the entire string as the key, resulting in a Secret with a single key 'username:admin' and an empty value, or an error. The correct syntax requires 'key=value'.
- ✓
kubectl create secret generic db-credentials --from-literal=username=admin --from-literal=password=S3cr3t! -n staging
Why this is correct
This command uses kubectl create secret generic with the --from-literal flag to specify key-value pairs directly. The -n staging flag targets the correct namespace. This is the standard way to create a Secret from literal values. The resulting Secret will have base64-encoded data for each key, which is the expected format for Kubernetes Secrets.
- ✗
kubectl create secret generic db-credentials --from-file=username=admin --from-file=password=S3cr3t! -n staging
Why it's wrong here
The --from-file flag expects a file path, not a key-value pair. Using it with 'username=admin' would treat 'admin' as a filename, which would fail because the file does not exist. To use --from-file, you would need actual files containing the values. This command is incorrect for the scenario.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 826 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.