After a kubeconfig leak, nobody can determine who deleted the lock-gate deployment on AKS. What should the security engineer configure for API-server accountability?
Select an answer to reveal the explanation.
Short Explanation
After a leaked kubeconfig, you need the API server’s paper trail. Pipe AKS control-plane and Kubernetes audit logs into Log Analytics via diagnostic settings—then you can see who deleted the lock-gate deployment.
Full Explanation
AKS diagnostic settings can send control-plane and Kubernetes audit logs to a Log Analytics workspace so security teams can investigate API-server operations such as deletions after credential exposure. Configuring that monitoring is the Domain 3 control. Authoring Sentinel analytics rules and KQL workbooks is Domain 4 and is not a substitute for enabling the audit log pipeline. Application stdout and kubeconfig soft delete do not provide Kubernetes API audit accountability.