Courseiva
← CAS-005
Full test
mediumMultiple ChoiceObjective-mapped

CAS-004 Practice Question: Refer to the exhibit

Exhibit

# kubectl describe pod my-app-pod
Name:         my-app-pod
Namespace:    default
Node:         worker-node-1/192.168.1.10
Start Time:   Tue, 15 Aug 2023 14:30:00 UTC
Labels:       app=my-app
Annotations:  none
Status:       Running
Containers:
  my-app-container:
    Container ID:   docker://abc123
    Image:          myregistry.com/my-app:v1.0
    Image ID:       docker-pullable://myregistry.com/my-app@sha256:xyz
    Port:           8080/TCP
    Host Port:      0/TCP
    State:          Running
    Started:        Tue, 15 Aug 2023 14:30:05 UTC
    Ready:          True
    Restart Count:  0
    Environment:
      DB_PASSWORD:   <set to the key 'db-password' in secret 'db-secret'>  Optional: false
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-abc (ro)

Refer to the exhibit. A security analyst notices that the pod is running with a service account token mounted. Which security best practice should be implemented to reduce the risk of token theft in container environments?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Set automountServiceAccountToken to false in the pod spec.

Setting automountServiceAccountToken to false in the pod spec prevents the automatic mounting of the service account token, reducing the risk of theft. Option A is incorrect because storing the token in a Kubernetes secret and mounting it still exposes the token, increasing rather than reducing risk. Option B is incorrect because changing the container runtime does not address the token mounting issue. Option C is incorrect because disabling the entire service account may break functionality if the pod needs API access; the goal is to prevent token exposure while still allowing explicit token mounting if necessary.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Store the token in a Kubernetes secret and mount it.

    Why it's wrong here

    Mounting tokens as secrets increases exposure and is not a security best practice.

  • ✗

    Use a different container runtime.

    Why it's wrong here

    The container runtime does not affect service account token mounting.

  • ✗

    Disable the service account for the pod.

    Why it's wrong here

    Disabling the service account is too restrictive and may break pod functionality that requires API access.

  • ✓

    Set automountServiceAccountToken to false in the pod spec.

    Why this is correct

    This prevents automatic mounting of the token, reducing theft risk while allowing explicit mounting if needed.

About these practice questions

This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.