AZ-204 Develop Azure compute solutions Practice Question
You are deploying a containerized application using Azure Kubernetes Service (AKS). You need to ensure that sensitive configuration data, such as API keys, is not stored in container images. Which Kubernetes resource should you use?
⚠ Common exam trap
A common mix-up: candidates confuse ConfigMaps with Secrets, assuming both are interchangeable for configuration, but ConfigMaps store data in plain text and are not secure for sensitive information, while Secrets provide base64 encoding and optional encryption for sensitive data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Secret
Kubernetes Secrets are specifically designed to store sensitive data like API keys, connection strings, and passwords. They are stored in etcd as base64-encoded values (and can be encrypted at rest) and are injected into pods as environment variables or mounted as volumes, ensuring the sensitive data never resides in the container image.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deployment
Why it's wrong here
A Kubernetes Deployment object is primarily responsible for declaratively managing the desired state of a set of identical pods, ensuring a specified number of replicas are running and handling updates or rollbacks. While a Deployment definition can reference secrets, it does not store sensitive data itself; its role is orchestration and lifecycle management of application instances, not secure data storage.
- ✗
ConfigMap
Why it's wrong here
A Kubernetes ConfigMap is designed for storing non-sensitive configuration data in key-value pairs, making it accessible to pods as environment variables, command-line arguments, or files within a volume. It is suitable for general application settings or configuration files, but it stores data in plain text, rendering it an insecure and inappropriate choice for sensitive information like API keys or database credentials.
- ✗
PersistentVolume
Why it's wrong here
A Kubernetes PersistentVolume (PV) represents a piece of durable, networked storage provisioned for use by stateful applications within the cluster, offering a persistent filesystem that outlives individual pods. Its purpose is to provide reliable storage for application data files, ensuring data availability across pod restarts or rescheduling. However, a PV is a storage resource for application data, not a mechanism for securely injecting sensitive configuration values into pods.
- ✓
Secret
Why this is correct
A Kubernetes Secret object is specifically engineered to store and manage sensitive information, such as passwords, OAuth tokens, and SSH keys, within the cluster. Secrets provide a more secure mechanism for injecting this data into pods compared to plain text in ConfigMaps or direct pod definitions. They can be mounted as data volumes or exposed as environment variables, with Kubernetes handling base64 encoding and offering integration with external secret management systems for enhanced security.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.