CKAD Practice Question: Application Environment, Configuration and Security
You need to create a Secret of type 'kubernetes.io/tls' for ingress. Which command is correct?
⚠ Common exam trap
Candidates often confuse the `--from-file` syntax from `kubectl create secret generic` with the dedicated TLS command, or misremember the flag names as `--certificate`/`--private-key` instead of the correct `--cert`/`--key`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl create secret tls my-tls --cert=cert.pem --key=key.pem
`kubectl create secret tls` is the dedicated command for creating a TLS secret, and it uses the `--cert` and `--key` flags to specify the certificate and private key files respectively. This creates a Secret of type `kubernetes.io/tls`, which is required for Ingress resources to terminate HTTPS traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl create secret generic my-tls --from-file=cert.pem --from-file=key.pem
Why it's wrong here
The generic subcommand creates an Opaque secret, so the resulting object lacks the kubernetes.io/tls type and the tls.crt/tls.key keys ingress controllers require. It is tempting because --from-file does embed the certificate and key, but the correct command is kubectl create secret tls with --cert and --key.
- ✗
kubectl create secret tls my-tls --certificate=cert.pem --private-key=key.pem
Why it's wrong here
The flags --certificate and --private-key do not exist; kubectl create secret tls accepts --cert and --key. The subcommand and secret type are right, which makes the option tempting, but the invalid flag names cause the command to fail rather than create the kubernetes.io/tls secret.
- ✗
kubectl create secret tls my-tls --from-file=tls.crt=cert.pem --from-file=tls.key=key.pem
Why it's wrong here
The tls subcommand does not accept --from-file; it requires --cert and --key, so this command errors out. It is tempting because the key names tls.crt and tls.key are exactly what the resulting secret must contain, but those keys are set automatically by the correct syntax.
- ✓
kubectl create secret tls my-tls --cert=cert.pem --key=key.pem
Why this is correct
`kubectl create secret tls` builds a `kubernetes.io/tls` Secret directly from a PEM certificate and its matching private key, satisfying the ingress TLS requirement. The `--cert` and `--key` flags map to the `tls.crt` and `tls.key` data fields that ingress controllers expect, avoiding manual base64 encoding.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKAD question from scratch — 826 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.