Correct Answer: Set automountServiceAccountToken: false in the Pod spec or ServiceAccount spec
By default, Kubernetes automatically mounts a ServiceAccount token inside containers at /var/run/secrets/kubernetes.io/serviceaccount. To disable this behavior for security hardeni...
Correct Answer
Set automountServiceAccountToken: false in the Pod spec or ServiceAccount spec
Why This Answer Is Correct
By default, Kubernetes automatically mounts a ServiceAccount token inside containers at /var/run/secrets/kubernetes.io/serviceaccount. To disable this behavior for security hardening, you can set automountServiceAccountToken: false in either the Pod or ServiceAccount configuration.
This question evaluates your knowledge of Kubernetes Core — a core concept tested in cloud certification exams. Understanding Kubernetes Core is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
To safely isolate resources (like Deployments and Services) belonging to different teams on the same cluster, you should use:
A developer wants to run a multi-container pod where a main application container writes files to a shared directory, and a secondary sidecar container reads and processes those files in real-time. How should the storage be shared between these two containers in the same Pod?
You have a Pod that needs access to a database configuration file (db-config.yaml) containing database endpoints, ports, and connection pool settings, and a database password. What is the Kubernetes best practice for storing and exposing these configurations to the Pod?
You have a database application pod that must wait for a configuration database service (config-db) to be fully running and accessible over the network before starting the main application container. What is the most resilient way to implement this dependency check?