CKS Monitoring, Logging and Runtime Security Practice Question
Which TWO of the following are valid audit stages in Kubernetes? (Choose two.)
⚠ Common exam trap
The trap is confusing the exact names of audit stages; candidates might recall 'RequestComplete' or 'ResponseFull' instead of the correct 'ResponseComplete' and 'RequestReceived'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ResponseComplete
In Kubernetes auditing, the audit policy defines stages that determine at which points in the request lifecycle an audit event is recorded. Option B, ResponseComplete, is a valid stage that logs an event after the API server has finished sending the response to the client, capturing the final outcome. Option C, RequestReceived, is a valid stage that logs an event as soon as the API server receives the request, before any processing occurs. The other options are not valid Kubernetes audit stages: ResponseFull, RequestProcessing, and RequestComplete do not exist in the audit.k8s.io API; the actual stages are RequestReceived, ResponseStarted, ResponseComplete, and Panic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ResponseFull
Why it's wrong here
ResponseFull is not a Kubernetes audit stage. The valid audit stages are RequestReceived, ResponseStarted, ResponseComplete, and Panic. This option appears to confuse the audit event lifecycle with HTTP response body streaming, but the API server never emits an event named ResponseFull. Audit data for responses is only captured at ResponseComplete, which covers the entire response once it has been fully written.
- ✓
ResponseComplete
Why this is correct
ResponseComplete is one of the four valid Kubernetes audit stages. It fires after the HTTP response has been fully transmitted to the client, meaning the audit event can include the complete response body, status code, and headers. This stage is essential for capturing full-response data for forensic analysis, though it may produce larger audit logs than earlier stages.
- ✓
RequestReceived
Why this is correct
RequestReceived is a valid Kubernetes audit stage that triggers immediately when the kube-apiserver receives a request, before any authorization or admission processing occurs. This stage is ideal for capturing the raw request metadata and body with minimal delay, and it is commonly used to detect abnormal request volumes. It is one of the four officially documented audit stages.
- ✗
RequestProcessing
Why it's wrong here
RequestProcessing is not a valid audit stage in Kubernetes. The audit system intentionally emits events only at well-defined boundaries in the request lifecycle, and 'processing' is an internal, continuous state that is not exposed as an event stage. The closest valid stage is ResponseStarted, which fires when the handler begins writing the response, not during arbitrary processing.
- ✗
RequestComplete
Why it's wrong here
RequestComplete is not a valid Kubernetes audit stage. There is no event emitted specifically when a request finishes being handled; instead, the response-completion event is called ResponseComplete. The request's arrival is captured at RequestReceived, and its outcome is captured at ResponseComplete, so a separate 'RequestComplete' stage is redundant and does not exist in the official audit stage list.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 845 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.