An organization requires real-time forwarding of audit events to a SIEM system. The SIEM endpoint expects JSON payloads over HTTPS and requires mutual TLS. Which audit backend should be configured?

Log file backend with a sidecar that tails the file and forwards to the SIEM.

Webhook backend configured with the SIEM URL and the appropriate CA and client certificates.

Log file backend with --audit-log-path set to the SIEM's network mount.

Dynamic audit backend using the AuditSink API.

Certified Kubernetes Security Specialist (CKS)

Domain 6Objective 5

Use Kubernetes Audit Logs to Monitor Access CKS Practice Questions (Page 3)

Part of the Monitoring, Logging and Runtime Security domain, which accounts for 20% of the CKS exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–16 in this domain), expect 2–3 from this objective — we provide 16 practice questions to prepare you well beyond it. (estimate)

16questions here

4free pages

6concepts

20%of the exam

Questions 11–15

11foundation · easy
Which audit log field is most useful for detecting a user attempting to access a resource they are not authorized to view?
Select an answer first
12application · medium
An organization requires real-time forwarding of audit events to a SIEM system. The SIEM endpoint expects JSON payloads over HTTPS and requires mutual TLS. Which audit backend should be configured?
Select an answer first
13foundation · easy
Which component is primarily responsible for generating Kubernetes audit events?
Select an answer first
14foundation · easy
When analyzing audit logs for security monitoring, which field helps you identify the specific resource that was accessed?
Select an answer first
15foundation · easy
Which audit log field indicates the HTTP method used in the API request?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKS

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKS” is a trademark of its owner, used for identification only.

Use Kubernetes Audit Logs to Monitor Access CKS Practice Questions (Page 3)

Questions 11–15

Which audit log field is most useful for detecting a user attempting to access a resource they are not authorized to view?

An organization requires real-time forwarding of audit events to a SIEM system. The SIEM endpoint expects JSON payloads over HTTPS and requires mutual TLS. Which audit backend should be configured?

Which component is primarily responsible for generating Kubernetes audit events?

When analyzing audit logs for security monitoring, which field helps you identify the specific resource that was accessed?

Which audit log field indicates the HTTP method used in the API request?

Keep studying — Monitoring, Logging and Runtime Security