CKS Minimize Microservice Vulnerabilities Practice Question
Which of the following is a best practice for storing sensitive information like database passwords in Kubernetes?
⚠ Common exam trap
Candidates often believe that environment variables are a secure way to pass secrets because they are 'injected' at runtime, but the trap is that environment variables are visible via /proc/self/environ, logs, and kubectl exec commands, making them less secure than volume mounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mount secrets as volumes in the pod
Mounting secrets as volumes ensures that sensitive data is stored in the in-memory tmpfs filesystem, which is never written to disk and is automatically removed when the pod is deleted. This approach also allows for automatic updates of secret values when the Secret object is modified, without requiring a pod restart, and provides better access control through filesystem permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use environment variables in the pod spec to pass secrets
Why it's wrong here
Environment variables can be exposed through /proc or logs; mounting is more secure.
- ✓
Mount secrets as volumes in the pod
Why this is correct
Mounting as volumes reduces the risk of exposure through environment variables.
- ✗
Embed secrets as literals in the pod YAML file
Why it's wrong here
This exposes secrets in the YAML and is not secure.
- ✗
Store them in ConfigMaps
Why it's wrong here
ConfigMaps are not designed for secrets and store data in plaintext.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 114-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CKS
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which of the following is a best practice for storing sensitive data like passwords in Kubernetes?
easy- A.Store them in ConfigMaps [wrong]
- ✓ B.Store them in Secrets and mount them as volumes [CORRECT]
- C.Store them as environment variables in the Pod spec [wrong]
- D.Store them as labels on Pods [wrong]
Why B: Kubernetes Secrets are designed to store sensitive data such as passwords, API keys, and certificates. Mounting a Secret as a volume ensures the data is written to a tmpfs in-memory filesystem (not to disk), reducing the risk of exposure via host filesystem access. This approach also avoids leaking secrets through environment variable dumps or logs, and supports automatic rotation when the Secret is updated.
Variation 2. Which of the following is the best practice for injecting secrets into a pod?
easy- A.Storing secrets in container image layers
- B.Using environment variables
- C.Using ConfigMap for secrets
- ✓ D.Injecting via volume mounts
Why D: Mounting secrets as volumes ensures that secret data is stored in the pod's filesystem as files, which are created in a tmpfs in-memory filesystem (ram-backed) and never written to disk. This approach also allows for automatic rotation of secret values when the Secret object is updated, without requiring a pod restart, and avoids exposing secrets in process listings or container logs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.