Study. uk . com
  1. Home
  2. All questions
  3. Question 933

CKA study material · question 933 of 1000

An auditor asks whether Kubernetes auditing would record someone reading a Secret file directly from a node's disk. What is the answer?

  1. Yes, the kubelet reports such reads as audit events
  2. Yes, if the audit policy sets the RequestResponse level for secrets
  3. Only when the node log query feature is enabled
  4. No; auditing records only what reached the API server
Show the answer

Answer: D. No; auditing records only what reached the API server

Audit records begin their lifecycle inside kube-apiserver, so activity that never goes through the API — such as reading files on a node — leaves no audit trail.

Source: Auditing (Kubernetes) — Auditing (body)

Challenge yourself on this topic → Study as cards