ConfigMaps are intended for non sensitive configuration data while Secrets are used to hold sensitive information is correct.

This is correct because ConfigMaps are designed to hold configuration such as feature flags endpoints and other non confidential settings while Secrets are intended to hold passwords tokens and keys that require restricted access. The cluster and platform determine how Secrets are protected and you should treat Secrets as sensitive even though basic encoding is used by default.

Secrets are automatically encrypted with Cloud KMS while ConfigMaps remain unencrypted is incorrect. Encryption using a cloud key management system is a cluster or provider feature and is not automatically applied to the Secret resource by Kubernetes itself.

ConfigMaps are stored as versioned objects while Secrets are not is incorrect. Both ConfigMaps and Secrets are regular Kubernetes API objects stored in etcd and both carry metadata such as resourceVersion so they can be updated and managed by the same API mechanisms.

ConfigMaps can only be mounted as files and Secrets may only be consumed as environment variables is incorrect. Both ConfigMaps and Secrets can be mounted as files or supplied as environment variables and there are additional consumption methods available through volumes and CSI drivers.

Full AWS Practitioner Certification Question