300-215 Question 88
Select 3A security analyst is investigating a potential security breach in a cloud-native application hosted on a Kubernetes cluster. The analyst needs to analyze logs to identify abnormal behavior. Using Cisco Secure Cloud Analytics, which types of logs would provide the most relevant data for detecting potential unauthorized access to the application?
- A
Application logs that record user transactions and API requests.
- B
Kubernetes audit logs that capture changes to resources and user activities.
- C
Network flow logs that show inbound and outbound traffic patterns.
- D
Container runtime logs that monitor container-level events such as crashes or restarts.
- E
System logs from the host operating system running the Kubernetes cluster.
Show answer and explanation
Correct answers: A, B, C
Explanation
To detect unauthorized access in a cloud-native application, it is crucial to analyze logs that provide insights into user activities, resource changes, and network traffic. Application logs, Kubernetes audit logs, and network flow logs offer the most relevant data for identifying potential breaches. While other logs may provide supplementary details, they do not directly address the primary concern of unauthorized access detection.
- A. Correct.
Application logs are critical for understanding user transactions and API request patterns, which can reveal unauthorized access attempts or abnormal usage.
- B. Correct.
Kubernetes audit logs provide detailed information about resource changes and user actions, which can help identify unauthorized modifications or suspicious activities.
- C. Correct.
Network flow logs are essential for analyzing traffic patterns and detecting anomalies such as unexpected data exfiltration or unauthorized connections.
- D. Incorrect.
While container runtime logs are useful for diagnosing container-level issues, they are less relevant for detecting unauthorized access to the application itself.
- E. Incorrect.
System logs from the host OS may provide some information about the infrastructure, but they are not as relevant for identifying application-specific unauthorized access or behavior.