mediumMultiple ChoiceObjective-mapped
CKS Practice Question: YAML snippets correctly configures a…
Which of the following YAML snippets correctly configures a ServiceAccount with automountServiceAccountToken set to false?
⚠ Common exam trap
CNCF often tests the distinction between setting `automountServiceAccountToken` on a ServiceAccount versus on a Pod, and the trap here is that candidates may confuse the correct placement (top-level spec vs. metadata) or think that setting it on a Pod is equivalent to configuring the ServiceAccount itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
apiVersion: v1 kind: ServiceAccount metadata: name: my-sa automountServiceAccountToken: false
It uses the correct field name `automountServiceAccountToken` at the top level of the ServiceAccount spec, which is the proper way to disable automatic mounting of the service account token in pods that use this ServiceAccount. This setting prevents the Kubernetes API token from being automatically injected into pods, enhancing security by reducing the attack surface for token theft.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
apiVersion: v1 kind: ServiceAccount metadata: name: my-sa token: automount: false
Why it's wrong here
The token field is not a valid field on a ServiceAccount. The ServiceAccount API has no nested token object; instead, automounting is controlled by the top-level boolean automountServiceAccountToken. Attempting to set token.automount will fail schema validation or be ignored, and the correct way to disable automatic token mounting is to set automountServiceAccountToken: false at the service account's root level.
- ✓
apiVersion: v1 kind: ServiceAccount metadata: name: my-sa automountServiceAccountToken: false
Why this is correct
This is the correct declaration to prevent Kubernetes from automatically mounting a service account token into pods that reference my-sa. The field automountServiceAccountToken is a top-level boolean on the ServiceAccount object, and setting it to false ensures no projected token volume is added to the pod's containers. This is the authoritative service-account-level control that the question is testing.
- ✗
apiVersion: v1 kind: Pod metadata: name: my-pod spec: serviceAccountName: my-sa automountServiceAccountToken: false
Why it's wrong here
Although a Pod can override token automounting via spec.automountServiceAccountToken, the question specifically asks for the YAML snippet that configures a ServiceAccount. That field on a Pod is valid but only influences that individual pod, not the service account's default behavior for all pods using it. Since the question asks for a ServiceAccount configuration, this pod-focused snippet is not the right answer.
- ✗
apiVersion: v1 kind: ServiceAccount metadata: name: my-sa automountServiceAccountToken: false
Why it's wrong here
Placing automountServiceAccountToken inside the metadata block is incorrect because metadata only supports recognized fields like name, namespace, labels, and annotations. Kubernetes API schema validation rejects unknown fields nested under metadata, and even if allowed, the automount field would not be read by the API server because it expects the field at the ServiceAccount's root. The correct placement is as a sibling to apiVersion, kind, and metadata.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 114-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.