Question 800 of 997

Kubernetes Fundamentals →hardMultiple ChoiceObjective-mapped

Using Kubernetes Secrets for Environment Variables

This KCNA practice question tests your understanding of kubernetes fundamentals. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

An application running in a Kubernetes cluster needs to securely access a third-party API. The API key must be stored in the cluster and mounted into the Pod as an environment variable. Which is the best practice?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "best"
Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

A
Create a Secret with the API key and use envFrom or valueFrom in the Pod spec.
Secrets are designed for confidential data and can be injected as environment variables.
B
Store the API key in a ConfigMap and reference it in the Pod spec.
Why wrong: ConfigMaps are for non-confidential data; Secrets are for sensitive data.
C
Embed the API key directly in the container image.
Why wrong: Embedding secrets in images is insecure and violates best practices.
D
Store the API key in a Pod annotation and read it with kubectl.
Why wrong: Annotations are not meant for secrets; they are metadata and not secure.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a Secret with the API key and use envFrom or valueFrom in the Pod spec.

Option A is correct because Kubernetes Secrets are specifically designed to store sensitive data like API keys, and using `envFrom` or `valueFrom` in the Pod spec injects the Secret value as an environment variable without exposing it in the Pod definition. This approach follows the principle of least privilege and avoids hardcoding secrets in images or plaintext ConfigMaps.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Create a Secret with the API key and use envFrom or valueFrom in the Pod spec.
Why this is correct
Secrets are designed for confidential data and can be injected as environment variables.
Clue confirmation
The clue word "best" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Store the API key in a ConfigMap and reference it in the Pod spec.
Why it's wrong here
ConfigMaps are for non-confidential data; Secrets are for sensitive data.
✗
Embed the API key directly in the container image.
Why it's wrong here
Embedding secrets in images is insecure and violates best practices.
✗
Store the API key in a Pod annotation and read it with kubectl.
Why it's wrong here
Annotations are not meant for secrets; they are metadata and not secure.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates often confuse ConfigMaps with Secrets, assuming both are equally secure for sensitive data, but Kubernetes tests the understanding that ConfigMaps store data in plaintext and are not encrypted, making them unsuitable for secrets like API keys.

Detailed technical explanation

How to think about this question

Under the hood, Kubernetes Secrets are stored in etcd, and by default they are base64-encoded (not encrypted), so enabling encryption at rest for etcd is recommended for production. When using `envFrom` with a Secret, the Secret's data keys become environment variable names, and the values are injected as literal strings; this avoids the need to mount files and reduces attack surface compared to volume mounts.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A junior network technician can log in to a core router but cannot reach the enable prompt or configuration mode. The AAA server is authenticating the login — but the authorisation policy only grants privilege level 1, not 15. Authentication (who you are) is working; authorisation (what you can do) is not.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related KCNA practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Kubernetes Fundamentals practice questions

Practise KCNA questions linked to Kubernetes Fundamentals.

Container Orchestration practice questions

Practise KCNA questions linked to Container Orchestration.

Cloud Native Architecture practice questions

Practise KCNA questions linked to Cloud Native Architecture.

Cloud Native Observability practice questions

Practise KCNA questions linked to Cloud Native Observability.

Cloud Native Application Delivery practice questions

Practise KCNA questions linked to Cloud Native Application Delivery.

KCNA fundamentals practice questions

Practise KCNA questions linked to KCNA fundamentals.

KCNA scenario practice questions

Practise KCNA questions linked to KCNA scenario.

KCNA troubleshooting practice questions

Practise KCNA questions linked to KCNA troubleshooting.

Practice this exam

Start a free KCNA practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

KCNA practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this KCNA question test?

Kubernetes Fundamentals — This question tests Kubernetes Fundamentals — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Create a Secret with the API key and use envFrom or valueFrom in the Pod spec. — Option A is correct because Kubernetes Secrets are specifically designed to store sensitive data like API keys, and using `envFrom` or `valueFrom` in the Pod spec injects the Secret value as an environment variable without exposing it in the Pod definition. This approach follows the principle of least privilege and avoids hardcoding secrets in images or plaintext ConfigMaps.

What should I do if I get this KCNA question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "best". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on KCNA

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A developer creates a pod that needs to securely access a database password stored in the cluster. Which Kubernetes resource should be used to inject the password as an environment variable?

easy

✓ A.Secret
B.ServiceAccount
C.ConfigMap
D.PersistentVolumeClaim

Why A: A Secret is the correct Kubernetes resource for injecting sensitive data like a database password into a Pod as an environment variable. Secrets store base64-encoded data and are designed specifically for confidential information, unlike ConfigMaps which store non-sensitive configuration. When mounted as environment variables, Secrets ensure the password is not exposed in plaintext in the Pod specification or image layers.

Variation 2. You have a pod that needs to securely access a database password. Which Kubernetes resource should you use to store the password?

medium

A.ServiceAccount
✓ B.Secret
C.ConfigMap
D.PersistentVolume

Why B: Option B is correct because a Kubernetes Secret is specifically designed to store sensitive data, such as database passwords, in a base64-encoded format. Secrets can be mounted as volumes or exposed as environment variables in a pod, ensuring the password is not stored in plaintext in the pod specification or container image.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.