KCNA Kubernetes Fundamentals Practice Question
You have a web application that needs to read configuration from a file and also access a database password. Which combination of resources should you use to manage these configurations securely?
⚠ Common exam trap
The CNCF often tests the misconception that Secrets are inherently secure because they are base64-encoded, leading candidates to think Secrets are safe for all data, when in fact base64 is not encryption and Secrets require additional encryption-at-rest configuration for true security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use ConfigMap for configuration file and Secret for database password
ConfigMap is designed for storing non-confidential configuration data like configuration files, while Secret is specifically for sensitive data such as database passwords. Secrets are base64-encoded and can be encrypted at rest using etcd encryption or KMS, providing a security boundary that ConfigMaps lack. This combination follows Kubernetes best practices for separating configuration from secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use ConfigMap for configuration file and Secret for database password
Why this is correct
Separating concerns: ConfigMap for non-sensitive, Secret for sensitive.
- ✗
Use ConfigMap for both
Why it's wrong here
Storing passwords in ConfigMap is insecure; Secrets should be used for sensitive data.
- ✗
Use PersistentVolume for configuration and environment variables for the password
Why it's wrong here
PersistentVolume is for persistent storage, not configuration.
- ✗
Use Secret for both
Why it's wrong here
Using a Secret for the configuration file is incorrect because Secrets are designed for sensitive data like passwords, not for non-sensitive configuration values that may need frequent updates without recreating the resource. This option is tempting because Secrets do securely store the database password, and in a scenario where both items were equally sensitive credentials, using Secrets for both would be valid.
Go deeper
Related to this question
About these practice questions
One of 833 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.