CKAD Practice Question: Application Environment, Configuration and Security
You create a ServiceAccount 'my-sa' with automountServiceAccountToken: false. A pod that references this ServiceAccount also sets automountServiceAccountToken: true in its spec. Will the service account token be mounted?
⚠ Common exam trap
CNCF often tests the precedence rule between ServiceAccount and pod-level settings, expecting candidates to incorrectly assume the ServiceAccount setting is authoritative or that the most restrictive setting wins.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Yes, because the pod spec setting takes precedence.
The pod spec's `automountServiceAccountToken: true` takes precedence over the ServiceAccount's `automountServiceAccountToken: false`. Kubernetes merges the ServiceAccount and pod-level settings, with the pod-level setting overriding the ServiceAccount's setting. Therefore, the token will be mounted into the pod.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Yes, because the pod spec setting takes precedence.
Why this is correct
In Kubernetes, the pod specification is the most authoritative source for pod-level settings. When a pod explicitly sets automountServiceAccountToken, that value overrides the automountServiceAccountToken field defined on the referenced ServiceAccount. This is by design: the ServiceAccount provides defaults, but the pod author retains final control over how the token is mounted. Therefore, even if the ServiceAccount has automountServiceAccountToken: false, a pod with automountServiceAccountToken: true will still have the token mounted.
- ✗
No, because the ServiceAccount has automountServiceAccountToken: false, which is a hard block.
Why it's wrong here
Setting automountServiceAccountToken: false on a ServiceAccount is not an immutable or mandatory block. It is a default value that applies only when the pod does not explicitly specify this field. Kubernetes documentation and API behavior show that the pod-level field takes precedence, so the ServiceAccount's false setting is effectively a soft default, not a hard prohibition. A pod can deliberately opt in to mount the token regardless of the ServiceAccount configuration.
- ✗
It depends on the namespace default settings.
Why it's wrong here
Namespace-level settings do not introduce any layer that overrides explicit pod or ServiceAccount configurations. There is no field like defaultAutomountServiceAccountToken on a Namespace object, and Kubernetes admission controllers do not inject such a default based on namespace. The only defaults that matter are the ServiceAccount's own field and the pod's explicit field. Thus, the outcome depends solely on those two values, with the pod taking precedence, not on the namespace.
- ✗
No, because the ServiceAccount setting overrides the pod setting.
Why it's wrong here
This claim reverses the actual precedence order in the Kubernetes API. The pod spec's automountServiceAccountToken is the higher-priority field; the ServiceAccount's setting acts merely as a fallback when the pod field is absent. When both are defined, the pod value wins, so the ServiceAccount cannot override the pod. For example, if the pod sets automountServiceAccountToken: true and the ServiceAccount sets false, the token is still mounted because the pod spec is authoritative.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKAD question from scratch — 826 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.