A security analyst is trying to determine if a pod was compromised by comparing its behavior to a baseline. They have access to logs, metrics, and traces. Which approach would be MOST effective?

Use audit logs to see all API requests made by the pod's service account

Use container logs to look for error messages

Use metrics to establish a baseline of CPU, memory, and network usage, and then alert on deviations from that baseline

Use traces to map the pod's normal request flow and alert on any new external calls

What is the purpose of Kubernetes audit logging?

To monitor node-level system metrics

To record all API requests to the cluster for security analysis

To collect application logs from containers

A platform team is designing a centralized logging solution for a multi-tenant cluster. They need to collect logs from all namespaces, but they want to avoid giving tenants access to logs from other tenants. Which approach would BEST satisfy this requirement?

Use a single log collection pod that only collects logs from the default namespace

Disable logging for all namespaces except the platform team's namespace

Deploy a DaemonSet that collects all logs to a central store, and use RBAC to restrict access to the log store per namespace

Have each tenant deploy their own log collection agent in their namespace

A security analyst is correlating data from multiple sources to detect a potential brute-force attack on the Kubernetes API server. Which combination of observability data would be MOST effective?

Jaeger traces of a single service and Grafana dashboards

Container logs from a single pod and Prometheus metrics for that pod's CPU usage

Audit logs showing repeated failed authentication attempts and metrics showing increased API server error rates

Kubernetes and Cloud Native Security Associate (KCSA)

Domain 4Objective 3

Observability KCSA Practice Questions (Page 2)

Part of the Platform Security domain, which accounts for 16% of the KCSA exam. Linux Foundation does not publish an official question count, but from its 90-minute exam (~35–60 total, ~6–10 in this domain), expect 1–1 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

6concepts

16%of the exam

Questions 6–10

6expert · hard
A security analyst is trying to determine if a pod was compromised by comparing its behavior to a baseline. They have access to logs, metrics, and traces. Which approach would be MOST effective?
Select an answer first
7foundation · easy
What is the purpose of Kubernetes audit logging?
Select an answer first
8foundation · easy
Which file is used to configure Kubernetes audit logging policies?
Select an answer first
9expert · hard
A platform team is designing a centralized logging solution for a multi-tenant cluster. They need to collect logs from all namespaces, but they want to avoid giving tenants access to logs from other tenants. Which approach would BEST satisfy this requirement?
Select an answer first
10application · medium
A security analyst is correlating data from multiple sources to detect a potential brute-force attack on the Kubernetes API server. Which combination of observability data would be MOST effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to KCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “KCSA” is a trademark of its owner, used for identification only.