KCSA Kubernetes Cluster Component Security Practice Question
A cluster administrator wants to implement admission control auditing to record all mutating and validating requests made to the API server. Which component configuration handles this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an audit policy file and pass its path to the API server via --audit-policy-file.
Kubernetes Audit Policy configuration files define what events are recorded and at what log level by the API server audit backend.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the kubelet audit webhook via /etc/kubernetes/audit.json.
Why it's wrong here
Auditing is an API server function, not a kubelet configuration option.
- ✗
Enable kube-proxy audit mode using --audit-proxy=true.
Why it's wrong here
Kube-proxy does not handle auditing for API requests.
- ✗
Set etcd logging level to DEBUG in the etcd configuration yaml.
Why it's wrong here
Etcd logs key-value store operations, not Kubernetes API admission events or user metadata.
- ✓
Configure an audit policy file and pass its path to the API server via --audit-policy-file.
Why this is correct
The API server uses an audit policy file referenced by flag to determine which requests are logged and how.
About these practice questions
This KCSA question is part of Courseiva's 320-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.