Which statement is true concerning secrets on Kubernetes master (API server)?

Secrets on Kubernetes master (API server) are not encrypted by default at rest, extra steps are needed to encrypt them. Kubernetes does not automatically encrypt secrets at rest, it is the responsibility of the user to ensure that the secrets are encrypted. There are several ways to encrypt secrets at rest, such as using Kubernetes native encryption, third-party encryption tools or using a cloud provider's encryption services.