A security engineer must enable audit logging on an existing Kubernetes cluster. The API server is running as a static pod managed by kubelet. The engineer needs to ensure the audit policy file is available to the API server and that audit events are written to a file on the control plane node. Which set of steps is required?

Create a ConfigMap with the audit policy, mount it into the API server pod, and set --audit-policy-file to the ConfigMap path.

Place the audit policy file on the control plane node, mount it into the API server static pod, add --audit-policy-file and --audit-log-path flags, then restart kubelet.

Enable audit logging via the kube-apiserver ConfigMap in the kube-system namespace and set the audit log path to a persistent volume.

Edit the API server manifest to add --audit-policy-file and --audit-log-path, then use kubectl apply to update the pod.

An auditor wants to verify that a specific user 'john' was denied access to create a deployment in the 'production' namespace. Which audit event fields should be examined to confirm this?

user.username, requestURI, and responseStatus.reason

user.username, verb, objectRef.resource, objectRef.namespace, and responseStatus.code

sourceIPs, userAgent, and responseStatus.code

objectRef.resource, objectRef.namespace, and requestReceivedTimestamp

Certified Kubernetes Security Specialist (CKS)

Domain 6Objective 5

Use Kubernetes Audit Logs to Monitor Access CKS Practice Questions (Page 1)

Part of the Monitoring, Logging and Runtime Security domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 16 practice questions to prepare you well beyond it. (estimate)

16questions here

4free pages

6concepts

20%of the exam

Questions 1–5

1foundation · easy
Which audit policy level provides the most detailed information about an API request?
Select an answer first
2application · medium
A security engineer must enable audit logging on an existing Kubernetes cluster. The API server is running as a static pod managed by kubelet. The engineer needs to ensure the audit policy file is available to the API server and that audit events are written to a file on the control plane node. Which set of steps is required?
Select an answer first
3application · medium
An auditor wants to verify that a specific user 'john' was denied access to create a deployment in the 'production' namespace. Which audit event fields should be examined to confirm this?
Select an answer first
4application · easy
A cluster administrator is explaining the audit logging pipeline to a new security analyst. Which component is responsible for generating audit events and sending them to the configured backend?
Select an answer first
5foundation · easy
Which kube-apiserver flag is used to specify the audit policy file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Use Kubernetes Audit Logs to Monitor Access CKS Practice Questions (Page 1)

Questions 1–5

Which audit policy level provides the most detailed information about an API request?

An auditor wants to verify that a specific user 'john' was denied access to create a deployment in the 'production' namespace. Which audit event fields should be examined to confirm this?

A cluster administrator is explaining the audit logging pipeline to a new security analyst. Which component is responsible for generating audit events and sending them to the configured backend?

Which kube-apiserver flag is used to specify the audit policy file?

Keep studying — Monitoring, Logging and Runtime Security