KCNA Cloud Native Observability Practice Question
What does the 'kubectl logs' command retrieve?
⚠ Common exam trap
KCNA often tests the distinction between different types of logs and events, and candidates may confuse 'kubectl logs' with 'kubectl get events' or assume it retrieves node-level logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Container logs
The 'kubectl logs' command retrieves the standard output (stdout) and standard error (stderr) streams from a container running in a pod. It directly accesses the container's log files on the node (e.g., /var/log/pods/...) or streams them from the container runtime. This is the primary way to debug application issues in Kubernetes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Audit logs
Why it's wrong here
Audit logs record API server requests for security and compliance review, not application output. The command reads a container's stdout/stderr stream. Audit logging is configured separately on the API server, so it would be the right source when investigating who changed a resource, not what a workload printed.
- ✗
Cluster events
Why it's wrong here
Cluster events are short-lived records of scheduling, pulling and probe failures, surfaced by kubectl get events or describe. kubectl logs instead streams a container's stdout/stderr. Events are the correct source for diagnosing why a pod will not start, not for reading application output.
- ✓
Container logs
Why this is correct
`kubectl logs` streams stdout and stderr captured by the container runtime for a specific container in a pod, satisfying the stem's request for container-level output. It reads from the node's log files rather than cluster events or API audit records, so it returns application output only.
- ✗
Node logs
Why it's wrong here
Node logs capture kubelet and container-runtime output on the host, which kubectl logs never reads. It is tempting because node-level diagnostics exist, but they are reached through journalctl or node log agents; kubectl logs streams stdout/stderr from a specific pod's container instead.
Go deeper
Related to this question
About these practice questions
One of 930 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.