mediumMultiple ChoiceObjective-mapped
CKS Practice Question: Enable audit logging for the Kubernetes API server
An administrator wants to enable audit logging for the Kubernetes API server. Which of the following is required?
⚠ Common exam trap
Candidates often think audit logging requires a feature gate (Option A) or confuse the kube-apiserver's audit flags with kubelet flags (Option D), or mistakenly believe RBAC permissions are needed to enable audit logging (Option C).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set --audit-log-path and --audit-policy-file flags on the kube-apiserver
Audit logging in Kubernetes is configured directly on the kube-apiserver component. The `--audit-log-path` flag specifies the file path where audit logs are written, and the `--audit-policy-file` flag points to a YAML file that defines which events (e.g., requests, responses, metadata) should be logged and at what level (e.g., Metadata, Request, RequestResponse). These flags are required to enable and control audit logging; no feature gate is needed because audit logging is built-in since Kubernetes 1.8.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable the AuditLogging feature gate
Why it's wrong here
Kubernetes uses feature gates to toggle alpha or beta features that are off by default, but audit logging is a stable API server capability and has no corresponding feature gate. Enabling audit logging is done by supplying the API server with a policy file and a log destination via command-line flags, not by flipping a feature gate. Attempting to enable AuditLogging as a feature gate would fail because no such gate exists.
- ✓
Set --audit-log-path and --audit-policy-file flags on the kube-apiserver
Why this is correct
Configuring the kube-apiserver with --audit-log-path and --audit-policy-file is the official, required method for enabling audit logging. The --audit-policy-file points to a YAML policy that defines which requests are audited and at what level, while --audit-log-path defines the file where the JSON audit records are written. Without these flags, the audit backend is not initialized even if the API server supports audit logging, so no audit events are ever emitted. Additional options like --audit-log-maxsize and --audit-log-maxbackup can be set for rotation.
- ✗
Create a ClusterRoleBinding with audit permissions
Why it's wrong here
Creating a ClusterRoleBinding grants RBAC permissions for users or service accounts to perform actions on resources, but it has no effect on whether the API server records audit logs. Audit logging is a server-side observability function that intercepts all requests, independent of authorization outcomes; RBAC resources are not consumed by the audit subsystem. No Kubernetes RBAC resource has 'audit permissions' because auditing is not an API operation. Therefore, a ClusterRoleBinding would not enable or influence audit logging.
- ✗
Set --audit-log-path flag on the kubelet
Why it's wrong here
The kubelet is a node-level agent that manages containers on a node and is not involved in serving the Kubernetes API, so it does not implement the API server's audit logging feature. Setting --audit-log-path on the kubelet would be an unrecognized flag (or it would simply redirect the kubelet's own diagnostic logs, not API audit events). The kubelet does not have access to the API server's audit policy or event stream, and enabling audit logging requires modifying the kube-apiserver's command-line arguments. Thus, this option confuses the kubelet with the kube-apiserver.
Go deeper
Related to this question
Learn chapter
Kubernetes Security Fundamentals
Key term
API Server Security
API Server Security refers to the practices, configurations, and controls that protect the Kubernetes API server from unauthorized access, data breaches, and malicious attacks.
Key term
Audit Logging
Audit logging is the process of recording a chronological, tamper-evident trail of who did what, when, and where inside a computer system or network.
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.