CKAD Practice Question: Application Environment, Configuration and Security
What is the primary purpose of a Kubernetes ServiceAccount?
⚠ Common exam trap
CKAD often tests the confusion between ServiceAccounts (workload identity) and user accounts (human identity) — candidates pick the option about granting permissions to users because they conflate authentication with authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To provide an identity for processes running in a Pod
A Kubernetes ServiceAccount provides an identity for processes running in a Pod, allowing them to authenticate to the Kubernetes API server and to external services. When a Pod is created, it can be assigned a ServiceAccount, and the API server then associates that identity with the Pod's requests. This is distinct from user accounts, which are for human users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To provide an identity for processes running in a Pod
Why this is correct
A ServiceAccount supplies a distinct identity that the Kubernetes API server associates with processes in a Pod. Workloads authenticate as that account when calling the API, and RBAC bindings grant the account specific permissions, decoupling Pod identity from individual users.
- ✗
To grant permissions to users
Why it's wrong here
Users authenticate through Microsoft Entra ID or client certificates and bind to Roles via RoleBindings; a ServiceAccount identifies processes running inside Pods, not human users. It is tempting because both appear in RBAC bindings, but the subjects differ.
- ✗
To define network policies for Pods
Why it's wrong here
Network policies are separate API objects selecting Pods by labels to control ingress and egress traffic; a ServiceAccount only provides an identity for API server authentication. It is tempting because both attach to Pods, yet ServiceAccounts grant no traffic-filtering capability.
- ✗
To store Docker registry credentials
Why it's wrong here
Docker registry credentials belong in an imagePullSecret referenced by the Pod spec, not a ServiceAccount, which supplies an identity for API access. It is tempting because ServiceAccounts can reference secrets, but that mechanism carries API tokens, not registry authentication.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 826-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.