Perform Behavioral Analytics to Detect Malicious Activities CKS Practice Questions (Page 6)

Questions 26–26

1. 26expert · medium

   A security engineer is configuring audit logging for a cluster that must comply with a policy requiring that all actions by service accounts be logged, but the cluster has a high volume of read-only requests from monitoring agents. The engineer wants to balance compliance with performance. Which audit policy configuration is most appropriate?

   • ACreate a rule that logs all service account requests at the Metadata level, and a separate rule that logs write operations at the RequestResponse level.
   • BUse the --audit-log-maxbackup flag to limit the number of backup files, so that storage is not exhausted.
   • CSet the audit policy to log only requests from service accounts that are not in the 'monitoring' group.
   • DLog all requests at the RequestResponse level, and use a separate log-shipping tool to filter out the monitoring agents' requests.
   Reveal Solution Discussion Select an answer first