CKS Minimize Microservice Vulnerabilities Practice Question
Which TWO of the following are valid arguments for the kubectl command to create a secret from a file? (Select TWO)
⚠ Common exam trap
The exam may trick candidates into selecting --from-literal (B) because they misinterpret 'from a file' as including inline data, or they may dismiss --from-env-file (E) believing it is only for ConfigMaps. Actually, --from-env-file works for both ConfigMaps and Secrets, so it is a valid method to create a secret from a file.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
--from-file
Options D and E are correct because both --from-file and --from-env-file are valid arguments for the kubectl create secret command when creating a secret from a file. --from-file reads the entire file content and uses the filename as the key. --from-env-file reads a file containing key=value lines, which is suitable for environment variable-style secrets. Option B (--from-literal) is incorrect because it specifies key-value pairs directly on the command line, not from a file. Option A (--dry-run) is a flag, not an argument for specifying secret data. Option C (--from-yaml) is not a valid argument for kubectl create secret.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
--dry-run
Why it's wrong here
--dry-run is a client-side flag that prints the Kubernetes object that would be created without actually sending it to the API server. It is often paired with -o yaml or -o json to output the manifest for review or further editing. It neither accepts nor processes secret data from a file; it merely simulates the operation, so it is not an argument for specifying file content and does not contribute to creating a secret from a file.
- ✗
--from-literal
Why it's wrong here
--from-literal is used to supply secret data directly as key=value pairs on the command line (e.g., --from-literal=password=secret). It does not read an external file's contents at all, so it cannot fulfill the requirement of creating a secret from a file. This flag is intended for inline, ad-hoc values rather than file-based input, making it incorrect for this specific scenario.
- ✗
--from-yaml
Why it's wrong here
--from-yaml is not a recognized flag for kubectl create secret; the valid data-source flags are --from-file, --from-literal, and --from-env-file. There is no built-in support for reading a YAML file directly as a secret source via this subcommand. To create a Secret from a YAML manifest, you would use kubectl apply -f on a Secret manifest rather than a creation flag, so --from-yaml is simply invalid.
- ✓
--from-file
Why this is correct
--from-file reads a file's content and creates a secret entry with the filename as the key and the file content as the value. This is a valid method to create a secret from a file.
- ✓
--from-env-file
Why this is correct
--from-env-file reads a file containing lines in key=value format and creates a secret from those entries. It works for both ConfigMaps and Secrets, making it a valid argument for creating a secret from a file.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 114-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.