KCSA Kubernetes Security Fundamentals Practice Question
An auditor notices that default ServiceAccounts in newly created namespaces are automatically mounting their API tokens into pods, creating an unnecessary attack surface. How can an administrator permanently disable automatic token mounting for all new service accounts in a specific namespace?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
By setting automountServiceAccountToken: false on the default ServiceAccount within that namespace.
Setting automountServiceAccountToken: false on the ServiceAccount resource prevents the token from being automatically mounted into pods using that service account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
By applying a PodSecurityPolicy with spec.hostNetwork set to false.
Why it's wrong here
Host network settings control network namespace sharing, not service account token mounting.
- ✗
By editing the kube-apiserver manifest to include the --disable-service-account-tokens flag.
Why it's wrong here
This flag does not exist in kube-apiserver; token mounting is controlled per ServiceAccount or per Pod.
- ✓
By setting automountServiceAccountToken: false on the default ServiceAccount within that namespace.
Why this is correct
Pods referencing that ServiceAccount will no longer automatically mount the token unless explicitly overridden in the pod spec.
- ✗
By creating a LimitRange that restricts secret volume mounts.
Why it's wrong here
LimitRanges constrain resource quantities (CPU, memory, storage request/limits), not service account tokens.
About these practice questions
This KCSA question is part of Courseiva's 320-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.