Auditing and Monitoring KCSA Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is reviewing audit logs and finds a series of events where a user 'bob' is repeatedly attempting to create pods with privileged: true. The attempts are failing with a 403 Forbidden status. Which conclusion is most likely?

   • ABob is attempting to escalate privileges and is being blocked by RBAC.
   • BThe API server is misconfigured and rejecting valid requests.
   • CBob is a legitimate administrator testing a new deployment.
   • DBob's account has been compromised and is being used by an attacker.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of Kubernetes audit logging?

   • ATo automatically block malicious requests before they reach the API server
   • BTo store the complete contents of etcd for backup and recovery purposes
   • CTo record all API server requests and responses for security analysis and compliance
   • DTo provide real-time metrics about cluster resource usage
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   During an incident investigation, an analyst finds audit log entries showing that a user 'alice' successfully created a pod in the 'kube-system' namespace. The pod spec includes a hostPID: true setting. Which additional audit log field would be most useful to determine if this was a malicious action?

   • AThe source IP address of the API request.
   • BThe user agent string of the client.
   • CThe request URI of the API call.
   • DThe response status code.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company runs a Kubernetes cluster and wants to send audit logs to an external SIEM for real-time alerting. They also want to retain a local copy for compliance. Which audit backend configuration should they use?

   • AConfigure only the webhook backend to send events to the SIEM.
   • BConfigure the log file backend to write to the SIEM's file system.
   • CConfigure only the log file backend to write to a local file.
   • DConfigure the webhook backend to send events to the SIEM and the log file backend to write to a local file.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which trust boundary separates the Kubernetes control plane from the worker nodes?

   • AThe node boundary
   • BThe network boundary
   • CThe user boundary
   • DThe pod boundary
   Reveal Solution Discussion Select an answer first