CKS · domain
Monitoring, Logging and Runtime Security
Practise Certified Kubernetes Security Specialist CKS Monitoring, Logging and Runtime Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.
Focused practice
Practice Monitoring, Logging and Runtime Security questions
Scored sessions drawing only from this domain — pick a length below.
What this domain covers
What to know about Monitoring, Logging and Runtime Security
Monitoring, Logging and Runtime Security questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Watch out for
Common Monitoring, Logging and Runtime Security exam traps
- ▸Answering from memory before reading the full scenario.
- ▸Missing a constraint such as cost, availability, security, scope or command context.
- ▸Choosing a broad answer when the question asks for the most specific fix.
- ▸Ignoring why the wrong options are tempting.
Question index
All Monitoring, Logging and Runtime Security questions (12)
Click any question to see the full explanation, or start a practice session above.
In a Falco rule, you have the condition: 'evt.type=execve and proc.name=bash and container.id!=host'. What does this rule detect?
Hard2Which TWO of the following are valid audit stages in Kubernetes audit logging?
Medium3During a runtime incident, you suspect a container has a reverse shell. Which kubectl command can you use to examine the container's running processes?
Medium4Which TWO of the following are valid audit stages in Kubernetes audit logging?
Medium5Which TWO of the following are valid audit stages in Kubernetes audit logging?
Medium6You are using `crictl` to debug a container that is not responding. Which command should you use to get the list of running containers?
Medium7You need to configure Kubernetes audit logging to log all requests to the 'secrets' API. Which audit policy level captures the body of the request?
Medium8What is the purpose of setting a container's filesystem to read-only in a Pod spec?
Easy9A Falco rule is written to detect when a shell is spawned inside a container. The rule condition is: `spawned_process and container and proc.name = bash`. The rule is not triggering. Which of the following is the most likely reason?
Hard10You are responding to a security incident where a pod named `compromised-pod` in namespace `default` is suspected of being used for cryptocurrency mining. You need to immediately isolate the pod from the network while preserving evidence. Which command sequence should you use?
Medium11Which TWO of the following are valid audit stages in Kubernetes?
Medium12Which THREE of the following are recommended steps when responding to a compromised pod?
HardOther domains
All CKS exam domains
Frequently asked questions
- What does the Monitoring, Logging and Runtime Security domain cover on the CKS exam?
- Monitoring, Logging and Runtime Security questions test whether you can apply the concept in context, not just recognise a definition.
- How many questions are in this domain?
- This page lists all 12 Monitoring, Logging and Runtime Security questions in the CKS question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only Monitoring, Logging and Runtime Security questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.