mediumMultiple Choice
CKS Practice Question: Enable encryption at rest for secrets in the…
You need to enable encryption at rest for secrets in the cluster. Which resource should you create to configure encryption providers?
⚠ Common exam trap
CNCF often tests the exact name of the Kubernetes resource, and candidates confuse EncryptionConfiguration with similar-sounding but nonexistent names like EncryptionProviderConfig or EncryptionPolicy, which are not part of the Kubernetes API.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EncryptionConfiguration
To enable encryption at rest for Kubernetes secrets, you must create an EncryptionConfiguration resource. This object defines which encryption providers (e.g., aesgcm, aescbc, secretbox, or identity) should be used to encrypt secrets stored in etcd. The API server reads this configuration from a file specified via the --encryption-provider-config flag, allowing you to control encryption at the provider level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
EncryptionConfiguration
Why this is correct
EncryptionConfiguration is the correct Kubernetes API resource (apiserver.config.k8s.io/v1) used to define encryption providers for etcd data at rest. It is passed to the kube-apiserver via the --encryption-provider-config flag, and its structure allows specifying providers such as aescbc, secretbox, or KMS-backed implementations, along with keys and ordering. This resource is the only recognized way to enable encryption at rest for Secrets, making it the valid choice.
- ✗
EncryptionProviderConfig
Why it's wrong here
No API object named EncryptionProviderConfig exists in Kubernetes. The legitimate type in the apiserver.config.k8s.io API group is called EncryptionConfiguration, which contains an array of 'providers' (e.g., aescbc, kms) within each resource entry. Although 'provider config' might sound like a plausible name, any attempt to submit this as a resource would be rejected because the kind is not registered with the control plane.
- ✗
EncryptionPolicy
Why it's wrong here
EncryptionPolicy is not a defined Kubernetes resource; the API server does not have a 'policy' kind for encryption. Policies like NetworkPolicy exist, but encryption is handled imperatively by a configuration file that is parsed and enforced at runtime, not by a declarative policy object stored in etcd. Always look for the exact kind EncryptionConfiguration when configuring encryption at rest.
- ✗
SecretEncryptionConfig
Why it's wrong here
SecretEncryptionConfig is not a recognized resource in any Kubernetes API group, and it does not exist as a built-in type. Encryption at rest is not Secret-specific; it applies to all supported resource types (including Secrets, ConfigMaps, and custom resources) through the single EncryptionConfiguration resource. Introducing a separate resource name like this ignores the unified design of the encryption configuration in the API server.
Go deeper
Related to this question
About these practice questions
One of 845 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.