KCSA Kubernetes Cluster Component Security Practice Question
Which service account permission model is used by default when a pod is created without specifying a service account name?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'default' service account in the pod's namespace.
Every namespace contains a service account named 'default' which is automatically assigned to pods if no other account is specified.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The 'default' service account in the pod's namespace.
Why this is correct
Pods automatically receive the default service account if none is provided.
- ✗
No service account is assigned.
Why it's wrong here
A service account is always assigned; however, token mounting can be disabled.
- ✗
The 'cluster-admin' service account.
Why it's wrong here
Giving cluster-admin to default pods would be an extreme security violation.
- ✗
The 'kube-system' privileged service account.
Why it's wrong here
Pods receive the default service account of their own specific namespace.
About these practice questions
One of 320 original KCSA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.