CKAD Practice Question: Application Environment, Configuration and Security
You have a ConfigMap named 'app-config' with key 'database.url'. Which environment variable definition correctly injects this value into a pod using a configMapKeyRef?
⚠ Common exam trap
The trap is that candidates might think the `name` field is optional or that `valueFrom` alone is sufficient. In reality, each environment variable injection via `valueFrom` must include the `name` field to define the variable name.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
- name: DATABASE_URL valueFrom: configMapKeyRef: name: app-config key: database.url
It properly defines an environment variable with a name and uses `valueFrom.configMapKeyRef` to reference the specific key 'database.url' from the ConfigMap 'app-config'. The `name` field is required in the env entry to specify the environment variable name. Option D is incorrect because it omits the `name` field, making the definition incomplete.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
- name: DATABASE_URL valueFrom: configMapKeyRef: name: app-config key: database.url
Why this is correct
This option is correct because it properly defines an environment variable named `DATABASE_URL` using the `name` field and combines it with a `valueFrom` block. The `configMapKeyRef` inside `valueFrom` specifies the ConfigMap `app-config` and the key `database.url`, which instructs Kubernetes to retrieve that specific value. This is the standard and complete syntax for referencing a single key from a ConfigMap as an environment variable.
- ✗
envFrom: - configMapRef: name: app-config
Why it's wrong here
Using `envFrom` with a `configMapRef` injects every key-value pair from the ConfigMap into the container's environment, which is not what this question requires. To expose a single key like `database.url` as a named environment variable, you must use an explicit `env` entry with `valueFrom` and `configMapKeyRef`. Additionally, `envFrom` does not allow you to rename keys or select only one key from the ConfigMap.
- ✗
- name: DATABASE_URL valueFrom: secretKeyRef: name: app-config key: database.url
Why it's wrong here
The mistake here is using `secretKeyRef`, which is designed to reference entries from a Kubernetes Secret, not a ConfigMap. Even though the resource named `app-config` exists, `secretKeyRef` will attempt to find a Secret with that name, and since it is a ConfigMap, the lookup will fail or return an error. The correct approach is to use `configMapKeyRef` in the same position, as shown in the correct answer.
- ✗
- valueFrom: configMapKeyRef: name: app-config key: database.url
Why it's wrong here
This snippet is incomplete because an environment variable definition in the `env` array requires a `name` field; without it, the YAML is invalid and Kubernetes will reject the pod specification. While the `valueFrom` block correctly identifies the ConfigMap and key, it must be paired with a `name` to tell the system which environment variable to create. The omission of `name: DATABASE_URL` is the sole reason this option fails.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKAD question from scratch — 160 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.