KCNA Kubernetes Fundamentals Practice Question
Which Kubernetes object should you use to store non-sensitive configuration data that can be consumed by Pods as environment variables or mounted files?
⚠ Common exam trap
Many candidates confuse ConfigMaps with Secrets, assuming both are interchangeable for configuration, but the KCNA exam tests the distinction that Secrets are for sensitive data and ConfigMaps are for non-sensitive data, and that PersistentVolume is for storage, not configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ConfigMap
ConfigMap is the correct Kubernetes object for storing non-sensitive configuration data, such as key-value pairs or configuration files. It is designed to decouple configuration artifacts from container images, allowing Pods to consume this data as environment variables, command-line arguments, or mounted files in a volume. Unlike Secrets, ConfigMaps do not provide encryption or base64 encoding by default, making them suitable only for non-sensitive information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Secret
Why it's wrong here
Secrets are for sensitive data, such as passwords or tokens.
- ✗
PersistentVolume
Why it's wrong here
PersistentVolume is used for storage, not configuration.
- ✓
ConfigMap
Why this is correct
ConfigMap is used to store non-confidential configuration data in key-value pairs.
- ✗
Service
Why it's wrong here
Service is a network abstraction, not for configuration data.
Go deeper
Related to this question
About these practice questions
This KCNA question is part of Courseiva's 833-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on KCNA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which Kubernetes object is used to store non-confidential configuration data that can be consumed by pods?
medium- A.ServiceAccount
- B.Secret
- ✓ C.ConfigMap
- D.PersistentVolume
Why C: ConfigMap is the correct Kubernetes object for storing non-confidential configuration data, such as environment variables, command-line arguments, or configuration files, that can be consumed by pods. Unlike Secrets, ConfigMaps store data in plain text and are designed for configuration that does not require encryption, making them ideal for application settings that are not sensitive.
Variation 2. You have a ConfigMap named 'app-config' and a Secret named 'db-password'. You want to mount them into a pod. Which statement is correct?
hard- A.Secrets can be mounted as volumes, but ConfigMaps cannot
- ✓ B.Both ConfigMaps and Secrets can be mounted as volumes
- C.ConfigMaps can be mounted as volumes, but Secrets cannot
- D.ConfigMaps and Secrets can only be exposed as environment variables
Why B: Both ConfigMaps and Secrets are Kubernetes API objects designed to decouple configuration data from container images. They can be mounted as volumes into pods, allowing files to be created in the container's filesystem with the data from the ConfigMap or Secret. This is a core feature for managing configuration and sensitive data in Kubernetes.
Variation 3. You need to provide configuration data as environment variables to a pod, but the data is not sensitive. Which object should you use?
medium- ✓ A.ConfigMap
- B.Secret
- C.ServiceAccount
- D.PersistentVolume
Why A: A ConfigMap is the correct Kubernetes object for providing non-sensitive configuration data as environment variables to a pod. ConfigMaps are designed to decouple configuration artifacts from image content to keep containers portable, and they support injection via environment variables, command-line arguments, or volume mounts. Unlike Secrets, ConfigMaps store data in plaintext (base64-encoded only for transport) and are intended for data that does not require encryption at rest or in transit.
Variation 4. Which TWO resources can be used to store configuration data separately from container images?
medium- A.Service
- B.PersistentVolume
- ✓ C.Secret
- D.Deployment
- ✓ E.ConfigMap
Why C: ConfigMaps and Secrets are Kubernetes API objects designed specifically to decouple configuration data and sensitive information from container images. ConfigMaps store non-sensitive key-value pairs (e.g., environment variables, command-line arguments, or configuration files), while Secrets store sensitive data (e.g., passwords, tokens, or SSH keys) in base64-encoded or encrypted form. Both can be mounted into pods as volumes or injected as environment variables, allowing image reuse across different environments without rebuilding.
Variation 5. Which Kubernetes object is used to store non-sensitive configuration data that can be consumed by pods?
medium- A.Secret
- B.ServiceAccount
- ✓ C.ConfigMap
- D.PersistentVolume
Why C: ConfigMap is the correct Kubernetes object for storing non-sensitive configuration data, such as environment variables, command-line arguments, or configuration files, that can be consumed by pods. Unlike Secrets, ConfigMaps store data in plaintext and are designed for configuration that does not require encryption, making them ideal for application settings that are not confidential.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.