A developer wants to debug a security issue in a pod that has already terminated. The pod's logs are no longer available via `kubectl logs`. What is the MOST likely reason for this?

The container's log files were deleted when the pod was terminated

The kubelet stopped forwarding logs to the API server

The container runtime does not support log collection

The audit policy did not include the pods/logs resource

A security analyst is reviewing observability data for signs of a crypto-mining attack. They notice a pod that was recently created and is consuming high CPU. Which additional signal would STRENGTHEN the hypothesis that this is malicious?

The pod's image was pulled from a public registry and the pod has no resource limits

The pod is running in the kube-system namespace

The pod's CPU usage is consistent with the requests specified in its manifest

The pod has a liveness probe configured

Which statement best defines observability in the context of Kubernetes security?

The ability to predict future system failures based on historical data.

The ability to infer the internal state of a system from its external outputs, such as logs, metrics, and traces.

The practice of collecting and storing all logs generated by a system for compliance purposes.

The process of monitoring system performance to ensure it meets service level agreements.

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 3

Observability KCSA Practice Questions (Page 1)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

16%of the exam

Questions 1–5

1application · medium
A developer wants to debug a security issue in a pod that has already terminated. The pod's logs are no longer available via `kubectl logs`. What is the MOST likely reason for this?
Select an answer first
2foundation · easy
Which observability tool is specifically designed for distributed tracing?
Select an answer first
3application · medium
A company wants to monitor cluster health and security posture using open-source tools. They already use Prometheus for metrics. Which tool would be the MOST appropriate to add for visualizing metrics and creating security dashboards?
Select an answer first
4application · medium
A security analyst is reviewing observability data for signs of a crypto-mining attack. They notice a pod that was recently created and is consuming high CPU. Which additional signal would STRENGTHEN the hypothesis that this is malicious?
Select an answer first
5foundation · easy
Which statement best defines observability in the context of Kubernetes security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.

Observability KCSA Practice Questions (Page 1)

Questions 1–5

A developer wants to debug a security issue in a pod that has already terminated. The pod's logs are no longer available via `kubectl logs`. What is the MOST likely reason for this?

Which observability tool is specifically designed for distributed tracing?

A company wants to monitor cluster health and security posture using open-source tools. They already use Prometheus for metrics. Which tool would be the MOST appropriate to add for visualizing metrics and creating security dashboards?

A security analyst is reviewing observability data for signs of a crypto-mining attack. They notice a pod that was recently created and is consuming high CPU. Which additional signal would STRENGTHEN the hypothesis that this is malicious?

Which statement best defines observability in the context of Kubernetes security?

Keep studying — Platform Security