CKAD Practice Question: Application Environment, Configuration and Security
You need to create a Pod that mounts a Secret named 'mysecret' as an environment variable 'SECRET_DATA'. The secret has a key 'password'. Which YAML snippet correctly achieves this?
⚠ Common exam trap
Many candidates confuse `configMapKeyRef` with `secretKeyRef` or swap the `name` and `key` fields, leading them to pick options that either reference the wrong resource type or misorder the required fields.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
env: - name: SECRET_DATA valueFrom: secretKeyRef: name: mysecret key: password
It uses the `secretKeyRef` field under `valueFrom` to reference a specific key from a Secret named 'mysecret' and inject its value into the environment variable `SECRET_DATA`. This is the standard Kubernetes syntax for exposing a Secret's key-value pair as an environment variable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
env: - name: SECRET_DATA valueFrom: configMapKeyRef: name: mysecret key: password
Why it's wrong here
This option incorrectly uses configMapKeyRef to reference a Secret. Even though the name field is set to 'mysecret', configMapKeyRef only resolves keys from ConfigMap resources; Kubernetes will look for a ConfigMap named 'mysecret' and fail or return nothing, since the actual resource is a Secret. Secret data must be accessed with secretKeyRef, which is the correct key reference for Secrets.
- ✓
env: - name: SECRET_DATA valueFrom: secretKeyRef: name: mysecret key: password
Why this is correct
This is the correct approach. secretKeyRef directly references the Secret object by name ('mysecret') and extracts the specific key ('password') from that Secret's data. When this env var is defined, Kubernetes fetches the decoded value of the 'password' key and injects it into the container's SECRET_DATA environment variable, fulfilling the requirement to mount the secret as an environment variable.
- ✗
env: - name: SECRET_DATA valueFrom: secretKeyRef: name: password key: mysecret
Why it's wrong here
This option swaps the name and key fields incorrectly. In secretKeyRef, 'name' must be the name of the Secret object (e.g., 'mysecret'), and 'key' must be the key inside that Secret (e.g., 'password'). Here, Kubernetes would attempt to find a Secret named 'password' and then expect a key 'mysecret' inside it, which does not match the actual Secret and key, so the env var would not be populated correctly.
- ✗
volumeMounts: - name: secret-volume mountPath: /etc/secret volumes: - name: secret-volume secret: secretName: mysecret items: - key: password path: secret.txt
Why it's wrong here
While this option does mount the Secret as files, it uses a volume mount, not an environment variable. The volume correctly references the Secret with secretName: 'mysecret' and maps the 'password' key to a file path, but the question specifically requires injecting the secret into an environment variable, which is done via env and secretKeyRef. A volume mount exposes the data as a file in the container's filesystem, not as an env var, so it does not meet the requirement.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 826-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.