CKAD kubernetes.io/ssh-auth Practice Question
Which TWO of the following are valid Kubernetes Secret types? (Select two.)
⚠ Common exam trap
Candidates often mistakenly believe that Opaque is not a valid Secret type because it is the default, but it is indeed valid. Also, be aware that kubernetes.io/password and kubernetes.io/configmap are not real Secret types.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubernetes.io/ssh-auth
kubectl create secret tls, kubectl create secret ssh-auth, and kubectl create secret generic (which creates an Opaque secret) are all valid Kubernetes Secret types. The type kubernetes.io/ssh-auth is used for SSH credentials, kubernetes.io/tls is used for TLS certificates, and Opaque is the default type for arbitrary user-defined data. Options A (kubernetes.io/password) and C (kubernetes.io/configmap) are not valid Secret types.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubernetes.io/password
Why it's wrong here
Incorrect. `kubernetes.io/password` is not a valid Kubernetes Secret type. Valid types include Opaque, kubernetes.io/tls, kubernetes.io/ssh-auth, etc.
- ✓
kubernetes.io/ssh-auth
Why this is correct
Correct. `kubernetes.io/ssh-auth` is a built-in Secret type for SSH credentials.
- ✗
kubernetes.io/configmap
Why it's wrong here
Incorrect. `kubernetes.io/configmap` is not a valid Secret type; ConfigMaps are a separate resource.
- ✓
kubernetes.io/tls
Why this is correct
The `kubernetes.io/tls` Secret type stores a TLS certificate and its associated private key, encoded as `tls.crt` and `tls.key` data fields respectively, which the kubelet automatically uses to secure pod-to-pod or ingress traffic. This satisfies the stem’s requirement for a valid, built-in Secret type that Kubernetes recognises for TLS termination, distinct from opaque or generic Secrets.
- ✓
Opaque
Why this is correct
Incorrect for this question. Although `Opaque` is a valid Secret type, the question expects the specific types `kubernetes.io/ssh-auth` and `kubernetes.io/tls` as the two answers.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKAD question from scratch — 160 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.