2V0-71-21 practice question 11 of 15

Which step must be taken to enable Kubernetes auditing on a Tanzu Kubernetes cluster?

Full set: 55 questions

Answer options

A: Set the ENABLE_AUDIT_LOGGING variable to ‘true’ before deploying the cluster Correct answer

B: Run systemctl start auditd && systemctl enable auditd on master node

C: Audit is enabled by default on every Tanzu cluster

D: Edit /etc/kubernetes/audit-policy.yaml and set ENABLE_AUDIT variable to ‘1’ on master node

Correct Answer:

A. Set the ENABLE_AUDIT_LOGGING variable to ‘true’ before deploying the cluster

Explanation

In VMware Tanzu Kubernetes Grid (TKG), cluster features are configured declaratively using a cluster configuration file before deployment. To enable the Kubernetes API server audit logging feature, the ENABLEAUDITLOGGING configuration variable must be set to true in the cluster's YAML manifest. This setting instructs the TKG control plane to configure the Kubernetes API server on the cluster with the necessary flags to activate audit logging upon creation. This declarative approach ensures consistent and reproducible cluster configurations, which is a core principle of infrastructure-as-code.

Why Incorrect

B. The auditd service is a general-purpose Linux system auditing daemon, which is distinct from the Kubernetes API server's specific audit logging functionality.
C. Kubernetes audit logging is disabled by default in Tanzu Kubernetes clusters to conserve storage and compute resources, as it can generate a high volume of log data.
D. While Kubernetes uses an audit policy file, enabling the feature is not done by setting a variable within this file. Configuration in TKG is managed declaratively through the cluster manifest, not by manually editing files on control plane nodes.

References

1. VMware Tanzu Kubernetes Grid Documentation: Configure Audit Logging for a Tanzu Kubernetes Cluster. This official document explicitly states, "To enable Kubernetes API server audit logging on a workload cluster, set the ENABLEAUDITLOGGING variable to true in the cluster configuration file before you deploy the cluster." It also confirms the default value is false. (Refer to the section "Enable and Disable Audit Logging").

2. VMware Tanzu Kubernetes Grid Documentation: Configuration File Variable Reference. This reference guide lists ENABLEAUDITLOGGING as the specific variable for this purpose. It describes its function: "Set to true to enable audit logging for the Kubernetes API server." (Refer to the table of configuration variables under the "Audit Logging" or similar section).

Keep practicing

Take the free 2V0-71-21 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test