Question 420 of 509

Attacks and Exploits →hardMultiple ChoiceObjective-mapped

Quick Answer

The correct technique is extracting a service account token from a running container and using it to access the Kubernetes API. This works because Kubernetes automatically mounts a service account token into every pod at /var/run/secrets/kubernetes.io/serviceaccount/token, and an attacker with node-level access can read that token from the container’s filesystem without needing cluster admin credentials. Once obtained, the token authenticates to the API server, and if the associated service account has broad RBAC bindings—such as cluster-admin—the tester can escalate privileges and access sensitive cluster resources. On the CompTIA PenTest+ PT0-002 exam, this scenario tests your understanding of Kubernetes post-exploitation and the common misconfiguration of over-privileged service accounts. A frequent trap is assuming you need to crack a password or exploit a vulnerability, but the real vector is the default token mount. Memory tip: “Token in the pod, keys to the cluster”—always check /var/run/secrets for mounted credentials.

PT0-002 Attacks and Exploits Practice Question

This PT0-002 practice question tests your understanding of attacks and exploits. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

During an internal penetration test, a tester compromises a server that is part of a Kubernetes cluster. The tester has access to the node's operating system but not to the cluster's administrative credentials. Which of the following techniques would most likely allow the tester to escalate privileges to cluster-admin or access sensitive resources within the cluster?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

Question 1hardmultiple choice

Full question →

A
Extracting a service account token from a running container and using it to access the Kubernetes API
Service account tokens are mounted inside pods. By entering a container (e.g., via the container runtime), the tester can read the token and authenticate to the API server, potentially with elevated rights.
B
Exploiting a kernel vulnerability on the node to escape to the host and then compromise the Kubernetes API server
Why wrong: The tester already has access to the node OS. Exploiting a kernel vulnerability would give root on the node but does not directly provide cluster-admin privileges.
C
Searching for a kubeconfig file on the node that contains a cluster-admin token
Why wrong: While possible, kubeconfig files on nodes typically have limited or node-specific permissions, not full cluster-admin. This is less reliable than using a service account token.
D
Modifying a ConfigMap to inject a malicious pod that runs with elevated privileges
Why wrong: Modifying a ConfigMap requires API access. The tester does not have authentication to the API server yet.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Extracting a service account token from a running container and using it to access the Kubernetes API

Option A is correct because service account tokens are automatically mounted into pods at /var/run/secrets/kubernetes.io/serviceaccount/token. An attacker with node-level access can extract this token from a running container's filesystem and use it to authenticate to the Kubernetes API server. Since service accounts are often granted broad permissions via RBAC bindings, this token may allow the tester to access sensitive resources or even escalate to cluster-admin if the service account has such privileges.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Extracting a service account token from a running container and using it to access the Kubernetes API
Why this is correct
Service account tokens are mounted inside pods. By entering a container (e.g., via the container runtime), the tester can read the token and authenticate to the API server, potentially with elevated rights.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Exploiting a kernel vulnerability on the node to escape to the host and then compromise the Kubernetes API server
Why it's wrong here
The tester already has access to the node OS. Exploiting a kernel vulnerability would give root on the node but does not directly provide cluster-admin privileges.
✗
Searching for a kubeconfig file on the node that contains a cluster-admin token
Why it's wrong here
While possible, kubeconfig files on nodes typically have limited or node-specific permissions, not full cluster-admin. This is less reliable than using a service account token.
✗
Modifying a ConfigMap to inject a malicious pod that runs with elevated privileges
Why it's wrong here
Modifying a ConfigMap requires API access. The tester does not have authentication to the API server yet.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates may assume kernel exploits (Option B) are always the best escalation path, but in Kubernetes, the service account token is a simpler and more direct method to access the API server from a compromised node.

Detailed technical explanation

How to think about this question

Kubernetes service account tokens are JSON Web Tokens (JWTs) signed by the cluster's token controller. They are mounted into pods automatically unless automountServiceAccountToken is set to false. The token can be used with kubectl or direct API calls (e.g., curl -H "Authorization: Bearer $(cat token)" https://api-server:6443/api/v1/namespaces/default/secrets). In real-world engagements, pentesters often find service accounts with overly permissive RBAC roles like cluster-admin, allowing immediate privilege escalation.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related PT0-002 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Planning and Scoping practice questions

Practise PT0-002 questions linked to Planning and Scoping.

Information Gathering and Vulnerability Scanning practice questions

Practise PT0-002 questions linked to Information Gathering and Vulnerability Scanning.

Attacks and Exploits practice questions

Practise PT0-002 questions linked to Attacks and Exploits.

Reporting and Communication practice questions

Practise PT0-002 questions linked to Reporting and Communication.

Tools and Code Analysis practice questions

Practise PT0-002 questions linked to Tools and Code Analysis.

PT0-002 fundamentals practice questions

Practise PT0-002 questions linked to PT0-002 fundamentals.

PT0-002 scenario practice questions

Practise PT0-002 questions linked to PT0-002 scenario.

PT0-002 troubleshooting practice questions

Practise PT0-002 questions linked to PT0-002 troubleshooting.

Practice this exam

Start a free PT0-002 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

PT0-002 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PT0-002 question test?

Attacks and Exploits — This question tests Attacks and Exploits — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Extracting a service account token from a running container and using it to access the Kubernetes API — Option A is correct because service account tokens are automatically mounted into pods at /var/run/secrets/kubernetes.io/serviceaccount/token. An attacker with node-level access can extract this token from a running container's filesystem and use it to authenticate to the Kubernetes API server. Since service accounts are often granted broad permissions via RBAC bindings, this token may allow the tester to access sensitive resources or even escalate to cluster-admin if the service account has such privileges.

What should I do if I get this PT0-002 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PT0-002 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-002 exam.