Question 664 of 866
CKS Minimize Microservice Vulnerabilities Practice Question
Which kubectl command would you use to create a Secret from a file named 'db-password.txt'?
⚠ Common exam trap
It's easy for candidates to confuse `kubectl create secret generic` with `kubectl create configmap` (Option B) or misuse `kubectl apply -f` (Option A) for non-manifest files, failing to recognize that Secrets require explicit creation commands and are distinct from ConfigMaps in purpose and handling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl create secret generic db-password --from-file=db-password.txt
`kubectl create secret generic` is the command to create a generic (opaque) Secret from a file using the `--from-file` flag. This reads the content of `db-password.txt` and stores it as a key-value pair in the Secret, where the key defaults to the filename. This is the standard method for creating a Secret from a plaintext file in Kubernetes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl apply -f db-password.txt
Why it's wrong here
Incorrect. `kubectl apply -f` is used to apply a Kubernetes manifest (YAML/JSON) from a file, not to create a Secret from a plain text file. The file `db-password.txt` is not a valid Kubernetes manifest.
- ✗
kubectl create configmap db-password --from-file=db-password.txt
Why it's wrong here
Incorrect. `kubectl create configmap` creates a ConfigMap, not a Secret. While the syntax is similar, Secrets and ConfigMaps are separate resources with different purposes and handling (e.g., Secrets are base64 encoded).
- ✗
kubectl create secret tls db-password --cert=db-password.txt
Why it's wrong here
Incorrect. `kubectl create secret tls` is used to create a TLS Secret from a certificate and key file, not a generic password. The flag `--cert` specifies the certificate file, not a password file.
- ✓
kubectl create secret generic db-password --from-file=db-password.txt
Why this is correct
Correct. `kubectl create secret generic` with `--from-file` creates a generic Secret where the content of the file is stored as a key-value pair. The key defaults to the filename, and the value is the file content.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CKS
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which command correctly creates a secret from a file named 'config.json'?
easy- A.kubectl create configmap my-secret --from-file=config.json
- ✓ B.kubectl create secret generic my-secret --from-file=config.json
- C.kubectl create secret tls my-secret --cert=config.json
- D.kubectl create secret generic my-secret --from-literal=config.json
Why B: `kubectl create secret generic` with `--from-file=config.json` reads the file content and stores it as a key-value pair in the Secret, where the key defaults to the filename ('config.json') and the value is the raw file data. This is the standard method for creating a generic Secret from a file in Kubernetes.
Last reviewed: Jul 4, 2026
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.