Skip to content
CKSMonitoring, Logging and Runtime SecuritySingle nodeMedium

Investigate an audit log and revoke access

Scenario cks-run-004 · about 8 minutes · 8 points · 3 grader checks

Use an exported audit log to identify who deleted a Secret and from where, then revoke that user's namespace access.

  • audit-logs
  • incident-response
  • jq
  • rbac
  • investigation

What you will practise

  • Filter audit events by verb, resource, name and response code
  • Tell a successful request from a denied attempt
  • Revoke access by removing RoleBindings

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-run-004

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

The Secret "db-root" in namespace "finance" was deleted. The audit log that was exported for the investigation is on exam-cp1 at /var/log/kubernetes/incident/audit.log (one JSON event per line). 1. Find the user who successfully deleted the Secret "db-root" in "finance". Write the username to /opt/incident/user.txt and the source IP address of that request to /opt/incident/ip.txt (exam-cp1, one value per file). 2. That user still has access to "finance" through a RoleBinding. Delete every RoleBinding in "finance" that grants this user access. Bindings of other users must stay.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Monitoring, Logging and Runtime Security
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
8
Grader checks
3
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 3 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Monitoring, Logging and Runtime Security labs

CKSMonitoring, Logging and Runtime SecurityHard

Audit logging with a tailored policy

Write an audit policy with per-resource levels and wire it into the API server static pod with log rotation.

Single node · ~10 min · 9 points

  • audit-logging
  • kube-apiserver
  • audit-policy
  • static-pod
  • monitoring

goldenkube start cks-run-001

CKSMonitoring, Logging and Runtime SecurityMedium

Immutable containers at runtime

Run nginx with a read-only root filesystem, keeping only the directories it really needs writable through emptyDir volumes.

Single node · ~8 min · 7 points

  • immutability
  • readonlyrootfilesystem
  • emptydir
  • runtime-security
  • deployment

goldenkube start cks-run-002

CKSMonitoring, Logging and Runtime SecurityMedium

Find and contain a crypto-miner process

Investigate running containers to find the one executing a mining process, record it and contain it without destroying evidence.

Single node · ~7 min · 8 points

  • runtime-security
  • incident-response
  • processes
  • behavioral-analytics
  • crictl

goldenkube start cks-run-003

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.