CKS Monitoring, Logging and Runtime Security Practice Question
Which TWO of the following are valid audit stages in Kubernetes?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Panic
Kubernetes audit stages include RequestReceived, ResponseStarted, ResponseComplete, and Panic. Among the given options, RequestReceived (D), ResponseStarted (C), and Panic (B) are all valid stages. Options A (ResponseReceived) and E (RequestSent) are not standard stages.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ResponseReceived
Why it's wrong here
ResponseReceived is not a standard audit stage; the correct stage is ResponseComplete.
- ✓
Panic
Why this is correct
Panic is a valid audit stage that captures events that cause a panic in the API server.
- ✓
ResponseStarted
Why this is correct
ResponseStarted is a valid audit stage, but in this question it is not one of the two correct answers.
- ✓
RequestReceived
Why this is correct
RequestReceived is a valid audit stage that records requests as soon as they are received.
- ✗
RequestSent
Why it's wrong here
RequestSent is not a standard audit stage; it does not appear in the official documentation.
Go deeper
Related to this question
About these practice questions
One of 114 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on CKS
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE stages can be configured for Kubernetes audit logging?
medium- A.RequestProcessed
- ✓ B.ResponseComplete
- ✓ C.Panic
- ✓ D.ResponseStarted
- ✓ E.RequestReceived
Why B: Kubernetes audit logging defines four stages: RequestReceived, ResponseStarted, ResponseComplete, and Panic. Therefore, options B, C, D, and E are all valid. Since the question explicitly asks for three stages, it is flawed; the correct set of all valid options is B, C, D, E.
Variation 2. Which TWO are valid stages in a Kubernetes audit event? (Select 2)
medium- ✓ A.RequestReceived
- ✓ B.ResponseStarted
- C.PreProcessing
- D.None
- E.PostProcessing
Why A: 'RequestReceived' is one of the defined stages in the Kubernetes audit event lifecycle. When an audit policy is configured, the kube-apiserver records an audit event at the 'RequestReceived' stage after it has received the request but before it has been processed by the admission controllers or the resource handler. This stage captures the raw request as it arrives.
Variation 3. Which TWO of the following are valid audit stages in Kubernetes? (Select 2)
medium- A.RequestEvaluated
- B.All of the above
- ✓ C.ResponseStarted
- ✓ D.RequestReceived
- E.ResponseSent
Why C: `ResponseStarted` is a valid Kubernetes audit stage that occurs when the audit handler starts sending the response to the client. This stage is part of the audit event lifecycle defined in the Kubernetes API server, capturing the moment the response headers are sent but before the body is fully transmitted.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.