Use Kubernetes Audit Logs to Monitor Access CKS Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A security analyst is investigating a potential data breach and needs to find all audit events where a specific secret was read. The analyst knows the secret name is 'db-password'. Which field in the audit log entry should be used to filter for this secret?

   • ArequestURI
   • BobjectRef.name
   • CresponseStatus.code
   • Duser.username
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is required to enable audit logging in the kube-apiserver?

   • ABoth --audit-policy-file and --audit-log-path (or webhook config)
   • BOnly the --audit-webhook-config-file flag
   • COnly the --audit-policy-file flag
   • DOnly the --audit-log-path flag
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In an audit log entry, which field indicates the user who made the API request?

   • ArequestURI
   • Bverb
   • Cuser.username
   • DsourceIPs
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which audit log backend sends audit events to an external HTTP endpoint?

   • AWebhook backend
   • BSyslog backend
   • Cetcd backend
   • DLog file backend
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is investigating a potential privilege escalation and finds an audit entry with "user": {"username": "alice"}, "impersonatedUser": {"username": "admin"}, "verb": "create", "objectRef": {"resource": "pods", "namespace": "default"}. What does this entry indicate?

   • AAlice attempted to create a pod but was denied.
   • BAlice created a pod in the default namespace while impersonating the admin user.
   • CAdmin created a pod in the default namespace using Alice's credentials.
   • DAdmin created a pod in the default namespace while impersonating Alice.
   Reveal Solution Discussion Select an answer first