KCNA Kubernetes Fundamentals Practice Question
An application running in a Kubernetes cluster needs to securely access a third-party API. The API key must be stored in the cluster and mounted into the Pod as an environment variable. Which is the best practice?
⚠ Common exam trap
Test-takers frequently confuse ConfigMaps with Secrets, assuming both are equally secure for sensitive data, but Kubernetes tests the understanding that ConfigMaps store data in plaintext and are not encrypted, making them unsuitable for secrets like API keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Secret with the API key and use envFrom or valueFrom in the Pod spec.
Kubernetes Secrets are specifically designed to store sensitive data like API keys, and using `envFrom` or `valueFrom` in the Pod spec injects the Secret value as an environment variable without exposing it in the Pod definition. This approach follows the principle of least privilege and avoids hardcoding secrets in images or plaintext ConfigMaps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Secret with the API key and use envFrom or valueFrom in the Pod spec.
Why this is correct
Secrets are designed for confidential data and can be injected as environment variables.
- ✗
Store the API key in a ConfigMap and reference it in the Pod spec.
Why it's wrong here
ConfigMaps are for non-confidential data; Secrets are for sensitive data.
- ✗
Embed the API key directly in the container image.
Why it's wrong here
Embedding secrets in images is insecure and violates best practices.
- ✗
Store the API key in a Pod annotation and read it with kubectl.
Why it's wrong here
Annotations are not meant for secrets; they are metadata and not secure.
Go deeper
Related to this question
About these practice questions
One of 833 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on KCNA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer creates a pod that needs to securely access a database password stored in the cluster. Which Kubernetes resource should be used to inject the password as an environment variable?
easy- ✓ A.Secret
- B.ServiceAccount
- C.ConfigMap
- D.PersistentVolumeClaim
Why A: A Secret is the correct Kubernetes resource for injecting sensitive data like a database password into a Pod as an environment variable. Secrets store base64-encoded data and are designed specifically for confidential information, unlike ConfigMaps which store non-sensitive configuration. When mounted as environment variables, Secrets ensure the password is not exposed in plaintext in the Pod specification or image layers.
Variation 2. You have a pod that needs to securely access a database password. Which Kubernetes resource should you use to store the password?
medium- A.ServiceAccount
- ✓ B.Secret
- C.ConfigMap
- D.PersistentVolume
Why B: A Kubernetes Secret is specifically designed to store sensitive data, such as database passwords, in a base64-encoded format. Secrets can be mounted as volumes or exposed as environment variables in a pod, ensuring the password is not stored in plaintext in the pod specification or container image.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.