CKS Minimize Microservice Vulnerabilities Practice Question
You are deploying an application that needs to access a database password stored in a Kubernetes Secret. To minimize risk, you should mount the Secret as a volume rather than using environment variables. Which of the following is the primary security benefit of using mounted volumes over environment variables?
⚠ Common exam trap
A common misconception tested in the exam is that mounted volumes are invisible in /proc or that they automatically rotate secrets, but the real security advantage is the reduced exposure of secrets to processes and commands that can list environment variables.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Environment variables can be leaked through commands like 'env' or 'cat /proc/1/environ', while mounted files are only accessible if the container has a shell and reads the file.
Environment variables are inherited by all processes in the container and can be read via commands like `env` or by accessing `/proc/1/environ` from any process, even without a shell. In contrast, secrets mounted as volumes are only accessible to processes that explicitly read the file path, and only if the container has a shell or the process has file system access. This reduces the attack surface by limiting exposure to processes that need the secret.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Environment variables can be leaked through commands like 'env' or 'cat /proc/1/environ', while mounted files are only accessible if the container has a shell and reads the file.
Why this is correct
Environment variables injected from Secrets are visible to any process that can read /proc/<pid>/environ or execute `env` inside the container; they are inherited by child processes and can appear in crash dumps, debug logs, and shell history. Mounted secret files, by contrast, are not broadcast through process metadata—an attacker must already have code execution in the container and explicitly read the file, which is a narrower, deliberate action. This is why the security recommendation is to mount secrets as files rather than pass them as environment variables.
- ✗
Mounted volumes are not visible in /proc, making them inaccessible to other processes.
Why it's wrong here
The claim misstates how the proc filesystem reveals mounts. Mounted volumes appear in /proc/mounts and /proc/self/mountinfo, so they are visible to any process that can read those files; moreover, a host process with CAP_SYS_ADMIN or root access can traverse into the container's mount namespace and read the files directly. Visibility in /proc is not what determines accessibility—permissions and capabilities do.
- ✗
Environment variables are stored in etcd in plaintext, while volumes are encrypted at rest.
Why it's wrong here
The storage of Secret data in etcd is identical regardless of whether it is later delivered as an environment variable or a file. etcd encryption at rest, configured through an EncryptionConfiguration, encrypts the entire Secret object—including both env-var values and volume file contents—so there is no distinction in ciphertext based on injection method. If etcd is unencrypted, both are plaintext at rest; neither delivery mechanism provides its own encryption.
- ✗
Mounted volumes automatically rotate the secret when the Secret object is updated.
Why it's wrong here
Although mounted Secret volumes do get updated when the Secret object changes (after the kubelet sync period), environment-variable-based Secrets do not, but this is a lifecycle convenience rather than a confidentiality advantage. An attacker with code execution can read either form once the container is running, so rotation of the mounted file doesn't meaningfully improve secrecy. The primary security reason to prefer mounted files is the reduced exposure of secret values through process listings and debugging tools, not automatic rotation.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 114-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.