CKAD Practice Question: Application Environment, Configuration and Security
Which of the following is the correct way to set an environment variable 'APP_COLOR' from a ConfigMap key 'color'?
⚠ Common exam trap
Many candidates confuse `configMapRef` (used in `envFrom` to import all keys) with `configMapKeyRef` (used in `env` to import a single key), leading candidates to choose Option A or B due to similar naming.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
env: - name: APP_COLOR valueFrom: configMapKeyRef: name: my-config key: color
It uses the `configMapKeyRef` field under `valueFrom` in the `env` array to inject a specific key from a ConfigMap as an environment variable. This is the standard Kubernetes syntax for referencing a single key from a ConfigMap, where `name` specifies the ConfigMap object and `key` specifies the key within that ConfigMap whose value will be assigned to the environment variable `APP_COLOR`.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
env: - name: APP_COLOR valueFrom: configMapRef: name: my-config key: color
Why it's wrong here
This option fails because the field is named `configMapRef`, but environment variable injection from a single ConfigMap key requires `configMapKeyRef`. The `configMapRef` structure is only valid inside an `envFrom` entry to import *all* keys, and it does not accept a `key` field. Since the API server would reject this manifest, the container would never start.
- ✗
envFrom: - configMapKeyRef: name: my-config key: color
Why it's wrong here
The `envFrom` array is designed to import every key from a ConfigMap as environment variables, not to cherry-pick a single key. Moreover, within an `envFrom` entry the correct field is `configMapRef` (not `configMapKeyRef`), and a `key` field is not permitted there—each imported key automatically becomes an env var name. If you want a specific key with a specific variable name, you must use `env` with `valueFrom.configMapKeyRef`.
- ✓
env: - name: APP_COLOR valueFrom: configMapKeyRef: name: my-config key: color
Why this is correct
This is correct because it uses the `env` array to define a single environment variable named `APP_COLOR`, then sources its value from the ConfigMap named `my-config` via `valueFrom.configMapKeyRef`, specifying the exact `key: color`. The `configMapKeyRef` field is the precise mechanism for pulling one key's value into an environment variable—it is the Kubernetes-standard way to make a ConfigMap value available inside a container under a chosen env var name.
- ✗
env: - name: APP_COLOR value: "configMap.color"
Why it's wrong here
Using `value: "configMap.color"` passes the literal string `configMap.color` to the container, not the value from the ConfigMap key `color`. The correct mechanism is `valueFrom` with a `configMapKeyRef` to dynamically inject the key’s value. This option is tempting because it resembles the syntax for referencing a Secret’s key in a volume mount, where a dot-separated path is valid, but environment variables require explicit field references.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKAD question from scratch — 160 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.