CKS Minimize Microservice Vulnerabilities Practice Question
An admin runs 'kubectl run test-pod --image=busybox --command -- sleep 3600' and then executes 'kubectl exec test-pod -- cat /var/run/secrets/kubernetes.io/serviceaccount/token'. The admin wants to prevent such access to the service account token. What is the correct action?
⚠ Common exam trap
Watch out — candidates often confuse network-level controls (NetworkPolicy) with filesystem-level access, or mistakenly think `runAsNonRoot` or removing the service account (which is not possible post-creation) would block token access, when the actual solution is to disable the automatic mount of the token.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set automountServiceAccountToken: false in the pod spec
Setting `automountServiceAccountToken: false` in the pod spec prevents the automatic mounting of the service account token into the container's filesystem. By default, Kubernetes mounts a token at `/var/run/secrets/kubernetes.io/serviceaccount/token`, which can be read via `kubectl exec` as shown. Disabling this mount blocks direct access to the token from within the pod, mitigating the risk of token theft or misuse.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the service account from the pod
Why it's wrong here
A Kubernetes Pod runs with an identity provided by a ServiceAccount; you cannot 'remove' a ServiceAccount from a Pod because each Pod automatically gets the 'default' ServiceAccount for its namespace unless explicitly overridden. Even if you set a ServiceAccount that has no associated token Secret, the kubelet would still mount the default token unless you disable mounting via automountServiceAccountToken. Thus, this option misses the real mechanism controlling token exposure.
- ✗
Set securityContext.runAsNonRoot: true
Why it's wrong here
Setting securityContext.runAsNonRoot: true instructs the container runtime to verify that the UID is non-zero before starting the container, which is a process-level security control. It does nothing to influence the kubelet's behavior when it projects the ServiceAccount token into the Pod's filesystem. The token would still be mounted and readable by the non-root user, so this does not prevent the exec command from accessing the credentials.
- ✓
Set automountServiceAccountToken: false in the pod spec
Why this is correct
The PodSpec boolean automountServiceAccountToken is the exact field the kubelet consults when deciding whether to project the ServiceAccount token into the container's filesystem. When set to false, the token volume is not automatically added to the Pod, so even a compromised or malicious command like 'exec cat /var/run/secrets/kubernetes.io/serviceaccount/token' would fail because the file simply does not exist. This is the intended, first-line mitigation for restricting credential exposure within a Pod.
- ✗
Use a NetworkPolicy to block access to the API server
Why it's wrong here
A NetworkPolicy can restrict egress network traffic to the Kubernetes API server, but the ServiceAccount token is a filesystem object mounted inside the Pod, not a network resource. An attacker who can exec into the container can still read the token file locally, regardless of egress restrictions, and could potentially exfiltrate it via a different network path. Therefore, NetworkPolicy addresses lateral network movement, not the initial token disclosure at the container level.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.