CKAD Practice Question: Application Environment, Configuration and Security
A Secret named 'db-secret' of type Opaque contains a key 'password'. How do you reference this key as an environment variable named 'DB_PASSWORD' in a pod spec?
⚠ Common exam trap
A common mix-up: candidates confuse `configMapKeyRef` with `secretKeyRef` — CNCF often tests whether candidates know that Secrets require `secretKeyRef` while ConfigMaps use `configMapKeyRef`, and that `envFrom` with `secretRef` injects all keys, not a single key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
env: - name: DB_PASSWORD valueFrom: secretKeyRef: name: db-secret key: password
It uses the `secretKeyRef` field under `valueFrom` to reference a specific key from a Kubernetes Secret of type Opaque. The `secretKeyRef` is the proper mechanism to inject a single key from a Secret as an environment variable, mapping the key 'password' to the environment variable name 'DB_PASSWORD'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
env: - name: DB_PASSWORD valueFrom: configMapKeyRef: name: db-secret key: password
Why it's wrong here
Using configMapKeyRef attempts to pull from a ConfigMap, not a Secret. In Kubernetes, Secret data is exposed to containers via secretKeyRef, while configMapKeyRef only resolves keys from a ConfigMap resource. Since db-secret is a Secret, the API server would either fail to find a ConfigMap of that name or error on type mismatch, so the database password would never be injected.
- ✓
env: - name: DB_PASSWORD valueFrom: secretKeyRef: name: db-secret key: password
Why this is correct
This is the correct way to consume a specific key from a Secret as an environment variable. The secretKeyRef field tells the kubelet to read the value associated with the password key from the Secret named db-secret in the same namespace, then assign it to DB_PASSWORD. The Secret must exist before the Pod starts, otherwise the container creation will fail with a resolution error.
- ✗
envFrom: - secretRef: name: db-secret key: password
Why it's wrong here
The envFrom field with secretRef is valid for importing all key/value pairs from a Secret as environment variables, but it does not accept a key filter; the key field is not allowed under secretRef. Additionally, the syntax shown misplaces the Secret name inside a list entry, and using envFrom would inject every key from db-secret, not just password, potentially overriding other environment variables.
- ✗
env: - name: DB_PASSWORD value: "db-secret.password"
Why it's wrong here
Setting value to the string "db-secret.password" creates a literal environment variable, so DB_PASSWORD would contain the literal text db-secret.password rather than the actual secret value. This approach never queries the Kubernetes API and provides no access to the Secret's data, leaving the password hardcoded and exposing it in the Pod spec. To reference Secret data, you must use valueFrom with secretKeyRef.
Go deeper
Related to this question
About these practice questions
One of 160 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.