CKS Minimize Microservice Vulnerabilities Practice Question
You need to encrypt Kubernetes secrets at rest. Which resource should you configure?
⚠ Common exam trap
A common Kubernetes certification pitfall is confusing the `EncryptionConfiguration` resource (the top-level configuration object) with the individual provider types like `KMSProvider` or `aescbc` that are listed inside it. Candidates may pick a provider name instead of the configuration resource itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
EncryptionConfiguration
Kubernetes uses an `EncryptionConfiguration` object to configure encryption at rest for secrets and other resources in etcd. This YAML-based resource defines which providers (e.g., `aescbc`, `kms`, `secretbox`) are used to encrypt data before it is written to the underlying storage. The API server reads this configuration from a file specified via the `--encryption-provider-config` flag, enabling transparent encryption and decryption of resource data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
EncryptionProvider
Why it's wrong here
EncryptionProvider is not a Kubernetes API resource. The control plane consumes an EncryptionConfiguration object, which enumerates provider types such as aescbc, kms, and secretbox to encrypt resources at rest. Attempting to create an EncryptionProvider kind would fail because no such resource exists in the API server.
- ✗
SecretEncryptionConfig
Why it's wrong here
SecretEncryptionConfig is not a recognized resource name in Kubernetes. Encryption at rest is configured globally via the EncryptionConfiguration resource, which applies to all supported resources, including Secrets, rather than a dedicated Secret-specific config object. The API server does not expose a kind called SecretEncryptionConfig.
- ✗
KMSProvider
Why it's wrong here
KMSProvider is not a standalone API resource but rather one of the provider types you can declare inside the providers list of an EncryptionConfiguration. It leverages a Key Management Service for envelope encryption and is referenced by name within that configuration file. Confusing this provider with a top-level object misrepresents where KMS settings live.
- ✓
EncryptionConfiguration
Why this is correct
EncryptionConfiguration is the correct API resource, defined in apiserver.config.k8s.io/v1, that specifies encryption providers and their keys for etcd data. You pass it to the kube-apiserver via the --encryption-provider-config flag, and it governs how resources like Secrets are encrypted at rest. This is the only valid object among the options for configuring at-rest encryption.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.