CKAD Practice Question: Application Environment, Configuration and Security
Which TWO commands can be used to create a Secret from a file? (Select 2)
⚠ Common exam trap
Many exam-takers confuse `--from-file` with `--from-env-file` or think `kubectl create configmap` can create Secrets, but the CKAD exam tests precise command syntax and the distinction between Secret types (generic vs. TLS) and resource types (ConfigMap vs. Secret).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl create secret generic mysecret --from-file=key=file.txt
Both options A and E are valid commands to create a Secret from a file. Option A uses `--from-file` to read file contents and store them under a specified key. Option E uses `--from-env-file` to parse a file with key=value pairs and create a Secret for environment variables. Option C is incorrect for this question because `kubectl apply -f secret.yaml` applies a YAML manifest that defines a Secret, but it does not create a Secret directly from a file's contents in the same way as the `kubectl create secret` commands. The question asks for two commands that create a Secret from a file, and both A and E meet that criterion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
kubectl create secret generic mysecret --from-file=key=file.txt
Why this is correct
The generic subcommand with --from-file=key=file.txt explicitly assigns the file's contents to a chosen key inside the Secret's data map. This is the canonical way to create a Secret that holds a single arbitrary file, and kubectl automatically base64-encodes the value when the Secret is created, though the command line uses the raw file content. It is the recommended approach when you need to mount the file as a volume in a Pod.
- ✗
kubectl create configmap mysecret --from-file=file.txt
Why it's wrong here
This command targets the ConfigMap API, not the Secret API. While --from-file works similarly for ConfigMaps, the resulting object is a ConfigMap named mysecret, which is semantically unsuitable for sensitive data like passwords or API keys. Additionally, ConfigMap values are stored as plain text (not base64-encoded by default) and are not treated with the same access restrictions as Secrets in RBAC or encryption configurations.
- ✗
kubectl apply -f secret.yaml where secret.yaml contains data fields
Why it's wrong here
Incorrect for this question: While `kubectl apply -f secret.yaml` can create a Secret if the YAML file contains a Secret definition, it does not create a Secret directly from a file's contents using a single command; it applies a pre-defined manifest. The question specifies creating a Secret from a file using commands, which is more directly achieved by A and E.
- ✗
kubectl create secret tls mysecret --cert=file.txt
Why it's wrong here
The tls subcommand is a specialized generator for Kubernetes TLS secrets, expecting both a --cert (certificate) and a --key (private key) file. Issuing it with only --cert=file.txt will fail due to missing key; even if fully specified, it would create a Secret of type kubernetes.io/tls with keys tls.crt and tls.key, not a generic secret with arbitrary data. This is not a generic file import mechanism.
- ✓
kubectl create secret generic mysecret --from-env-file=file.txt
Why this is correct
Correct: `kubectl create secret generic mysecret --from-env-file=file.txt` creates a Secret from an environment file, where each line in the file represents a key-value pair. This is a valid way to create a Secret from a file.
Go deeper
Related to this question
About these practice questions
One of 160 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.