CKS Minimize Microservice Vulnerabilities Practice Question
A team wants to use an external secret manager (HashiCorp Vault) to inject secrets into pods. Which approach is most aligned with Kubernetes best practices?
⚠ Common exam trap
The CKS exam often tests the misconception that ConfigMaps or environment variables are acceptable for secrets, but the exam emphasizes that any secret stored in etcd (even if base64-encoded) is not secure, and the only best-practice approach is to use external secret stores with sidecar injection or CSI drivers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a mutating webhook that injects a sidecar container to fetch secrets and mount them as volumes
It follows the Kubernetes best practice of using a mutating admission webhook to inject a sidecar container (e.g., Vault Agent or Bank-Vaults) that authenticates with HashiCorp Vault, fetches secrets, and mounts them as volumes into the pod. This approach avoids storing secrets in etcd (as ConfigMaps or environment variables do) and eliminates the need for manual secret injection, aligning with the principle of least privilege and dynamic secret management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a ConfigMap to mount secrets as files
Why it's wrong here
ConfigMaps are not designed for secrets; they are not encrypted.
- ✗
Store secrets as environment variables in the pod spec
Why it's wrong here
Environment variables may leak in logs and are less secure than volumes.
- ✗
Use kubectl exec to copy secrets into the container at startup
Why it's wrong here
This is not scalable or secure; secrets would be visible in commands.
- ✓
Use a mutating webhook that injects a sidecar container to fetch secrets and mount them as volumes
Why this is correct
This approach securely injects secrets without exposing them in the pod spec.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.