KCSA Kubernetes Security Fundamentals Practice Question

An application pod requires access to the Kubernetes API to list other pods. To follow secure practices, you create a dedicated ServiceAccount and bind a custom Role to it. How should you configure the Pod specification to prevent the default service account token from being automatically mounted?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Set 'automountServiceAccountToken: false' in the Pod specification.

Setting 'automountServiceAccountToken: false' on either the ServiceAccount or the Pod specification prevents the automatic mounting of the token, reducing the blast radius if compromised.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Delete the 'default' ServiceAccount in the namespace.
Why it's wrong here
Deleting the default service account can cause unintended issues for controllers relying on it; disabling auto-mount is safer.
✓
Set 'automountServiceAccountToken: false' in the Pod specification.
Why this is correct
This setting stops the default token from being mounted into the pod's filesystem.
✗
Configure the Pod securityContext with 'readOnlyRootFilesystem: true'.
Why it's wrong here
readOnlyRootFilesystem makes the root filesystem read-only, but the service account token is mounted via a tmpfs volume, so it remains writable unless specifically prevented.
✗
Add a deny NetworkPolicy blocking egress to the Kubernetes API service IP.
Why it's wrong here
This would block legitimate API access required by the custom ServiceAccount.

Quick reference

AAA Protocol Comparison

Protocol	Port(s)	Encryption	Transport	Primary Use
RADIUS	1812 / 1813	Password only	UDP	Network access control
TACACS+	49	Full packet	TCP	Device administration
Diameter	3868	Full session	TCP / SCTP	Carrier / mobile networks
802.1X	—	EAP-based	Layer 2	Port-based access control

TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.

About these practice questions

Courseiva writes every KCSA question from scratch — 320 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint

Ready to practise?

Turn this into a habit — start a practice session.

Start practice session

Timed practice sets

Short scored sets — answer, get feedback, read the explanation, move on.

KCSA Practice Exam 1 — 20 Questions→KCSA Exam Simulation 1 — 100 Questions→

Domain-focused practice

Drill one exam section at a time instead of jumping between unrelated topics.

Kubernetes Security Fundamentals Compliance And Security Frameworks Platform Security

Filter by question format

Pick a question style and work only that format until it feels routine.

Browse scenarios

Practice by topic

One concept per page — questions, worked explanations, and a short concept guide.

Kubernetes Security Fundamentals practice questions Kubernetes Cluster Component Security practice questions KCSA troubleshooting practice questions KCSA fundamentals practice questions

Where to go next

All CNCF / Linux Foundation practice questions Study guide KCSA practice test

This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.