20+ practice questions focused on Monitoring, Logging and Runtime Security — one of the most tested topics on the Certified Kubernetes Security Specialist CKS exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Monitoring, Logging and Runtime Security PracticeYou are investigating a pod that is suspected of being compromised. You need to preserve the container's filesystem for forensic analysis. Which `crictl` command should you use to export the container's filesystem as a tar archive?
Explanation: `crictl export` is the dedicated command to export a container's filesystem as a tar archive, preserving its state for forensic analysis. This command creates a snapshot of the container's root filesystem, which is essential for offline investigation without altering the running container.
You are configuring Kubernetes audit logging. You want to log all requests to the `secrets` resource in the `kube-system` namespace at the `RequestResponse` level, while logging all other requests at the `Metadata` level. Which audit policy configuration achieves this?
Explanation: It defines an audit policy rule that matches requests to the `secrets` resource (core API group, empty string) in the `kube-system` namespace and sets the audit level to `RequestResponse`, which logs both the request metadata and the response body. The subsequent `- level: Metadata` rule acts as a catch-all for all other requests, logging only metadata. Audit policy rules are evaluated in order, and the first matching rule applies, so the specific rule for secrets must come before the general rule.
You have deployed a pod and set `securityContext.readOnlyRootFilesystem: true`. The pod is failing to start with an error about writing to `/tmp`. What is the most likely cause?
Explanation: When `securityContext.readOnlyRootFilesystem: true` is set, the container's root filesystem becomes read-only. Many applications, including those that write temporary files, expect to write to `/tmp`. Without a writable volume mounted at `/tmp`, the container fails to start because it cannot write to that directory. Mounting an `emptyDir` volume at `/tmp` provides a writable location that is ephemeral and tied to the pod's lifecycle, resolving the issue.
An administrator runs `kubectl exec -it nginx-pod -- sh` and inside the container runs `curl http://example.com`. This succeeds. However, the administrator wants to detect such outbound connections using Falco. Which syscall should Falco monitor to detect this network connection?
Explanation: The `connect` syscall is invoked when a client initiates an outbound TCP connection, such as when `curl http://example.com` is run inside the container. Falco monitors syscalls at the kernel level, and detecting `connect` allows it to capture the destination IP and port of the outbound request. This is the correct syscall to monitor for outbound network connections.
You are writing a Falco rule to detect when a container tries to read the file `/etc/shadow`. Which condition in the Falco rule correctly matches this event?
Explanation: Falco rules use conditions that match system calls (evt.type) and file descriptors (fd.name). The event type 'open' is the syscall used to open a file for reading, and fd.name='/etc/shadow' specifies the target file. This combination correctly detects when a container attempts to open /etc/shadow, which is the typical first step before reading it.
+15 more Monitoring, Logging and Runtime Security questions available
Practice all Monitoring, Logging and Runtime Security questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Monitoring, Logging and Runtime Security. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Monitoring, Logging and Runtime Security questions on the CKS frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Monitoring, Logging and Runtime Security is tested as part of the Certified Kubernetes Security Specialist CKS blueprint. Practicing with targeted Monitoring, Logging and Runtime Security questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CKS practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Monitoring, Logging and Runtime Security is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Monitoring, Logging and Runtime Security practice session with instant scoring and detailed explanations.
Start Monitoring, Logging and Runtime Security Practice →