CKAD Practice Question: Application Environment, Configuration and Security
A pod has 'automountServiceAccountToken: false' in its spec. What is the effect?
⚠ Common exam trap
Many candidates confuse `automountServiceAccountToken: false` with disabling API access entirely, but it only disables the automatic token mount—the pod can still use other authentication methods to reach the API.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service account token is not mounted into the pod
Setting `automountServiceAccountToken: false` in a Pod spec explicitly prevents the automatic mounting of the service account token into the Pod's containers. By default, Kubernetes mounts a token at `/var/run/secrets/kubernetes.io/serviceaccount/token` for API authentication; disabling it means the token is not present in the container filesystem, so the Pod cannot authenticate to the Kubernetes API using that default mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The pod uses the default service account token from the namespace
Why it's wrong here
This is incorrect because automountServiceAccountToken: false explicitly disables automatic token injection, so the pod will not receive the default service account token from its namespace at all. The pod would need a manually defined volume to obtain any token, and without that, it has no credentials on its filesystem. This setting does not fall back to a different service account; it simply prevents the secret from being mounted.
- ✗
The service account token is mounted but not updated
Why it's wrong here
This is false because the setting prevents the token from being mounted, so there is no token file present to be updated or rotated. Token rotation applies to projected service account tokens that are actively mounted with an expiration; since no automatic volume is created, the pod never receives any token. The automount flag neither delays nor disables rotation; it eliminates the mount entirely.
- ✗
The pod cannot communicate with the Kubernetes API
Why it's wrong here
This is wrong because the pod can still communicate with the Kubernetes API via alternative authentication methods, such as a manually mounted token, a sidecar that supplies credentials, or an external identity provider. Disabling automountServiceAccountToken only removes the default token from the filesystem; it does not block network connectivity or API endpoints. For example, you can mount a service account token from a secret using a custom volume, or use pod identity add-ons that inject credentials over the network.
- ✓
The service account token is not mounted into the pod
Why this is correct
Setting automountServiceAccountToken to false in the pod spec tells the kubelet not to project the namespace's default service account token into the pod. As a result, no token appears under /var/run/secrets/kubernetes.io/serviceaccount, and the pod has no automatic bearer credentials for API requests. This is a deliberate security hardening measure for workloads that do not require Kubernetes API access, limiting the blast radius if the pod is compromised.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 826-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.