hardMultiple ChoiceObjective-mapped
CKS automountServiceAccountToken Practice Question
A cluster administrator wants to ensure that a specific service account (my-sa) cannot have its token mounted automatically in pods. Which setting should be applied to the service account?
⚠ Common exam trap
Candidates may incorrectly assume that a Kubernetes annotation exists to disable automatic token mounting, but the correct approach is to set the automountServiceAccountToken field in the ServiceAccount's spec.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
automountServiceAccountToken: false
Setting `automountServiceAccountToken: false` in the ServiceAccount spec prevents pods that use that service account from automatically mounting its token. Note that this is a spec field, not an annotation; the question's wording is slightly misleading. Options A and C are incorrect because they use string values or wrong syntax. Option D is incorrect because the annotation `kubernetes.io/enforce-mountable-secrets` does not exist in Kubernetes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
automountServiceAccountToken: "false"
Why it's wrong here
While `automountServiceAccountToken` is the correct field, the value must be a boolean, not a string. In YAML, quoting a value like `"false"` creates a string, and the Kubernetes API expects a boolean for this field, so a properly applied manifest would be rejected with a type error (e.g., "cannot convert string to bool"). Even if a client silently coerced it, the semantic intent is ambiguous and unexpected; always use unquoted `false` (or `true`) to match the API schema.
- ✓
automountServiceAccountToken: false
Why this is correct
Setting `automountServiceAccountToken: false` on the ServiceAccount is the correct, officially supported way to disable automatic mounting of the service account token for all Pods that reference this ServiceAccount. When a Pod is created, the kubelet normally projects the token, CA bundle, and namespace into the container at `/var/run/secrets/kubernetes.io/serviceaccount`; this boolean field overrides that default behavior. Individual Pods can still re-enable mounting by explicitly setting `automountServiceAccountToken: true` in the Pod spec, since Pod-level settings take precedence over the ServiceAccount-level setting.
- ✗
mount-token: "false"
Why it's wrong here
There is no field named `mount-token` in the ServiceAccount API or any Pod specification. Kubernetes only exposes token mounting through the `automountServiceAccountToken` boolean field on a ServiceAccount or Pod spec. Supplying a YAML key like `mount-token` would either be rejected as an unknown field by the API server or silently ignored depending on validation strictness, so it has no effect on mounting behavior.
- ✗
kubernetes.io/enforce-mountable-secrets: "true"
Why it's wrong here
The annotation `kubernetes.io/enforce-mountable-secrets` is not recognized by any Kubernetes component. While Kubernetes preserves unknown annotations, it does not act on them; only a controller with specific code can enforce behavior based on annotations. Restricting which ServiceAccounts can mount secrets is not a built-in feature; the closest built-in behavior is disabling token mounting via `automountServiceAccountToken: false` or using an admission policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.