300-215 Question 89
Single answerA cybersecurity analyst is investigating suspicious activity in a cloud-native application hosted on a Kubernetes cluster. Using Cisco Secure Cloud Analytics, the analyst identifies unusual outbound traffic from a specific container. To further investigate, which log source should the analyst prioritize to determine if the application code or environment was compromised?
- A
Container runtime logs
- B
Host operating system audit logs
- C
Kubernetes API server logs
- D
Virtual network flow logs
Show answer and explanation
Correct answer: A
Explanation
In cloud-native environments, such as those using Kubernetes, container runtime logs are critical for identifying malicious activity within containers. These logs provide granular details about commands executed, file access, and other container-specific activities, making them the most relevant log source for investigating potential application code or environment compromises.
- A. Correct.
Container runtime logs provide detailed information about the execution of containers, including any commands executed inside the container, which can help identify malicious activity or unauthorized access to the application environment.
- B. Incorrect.
Host operating system audit logs track activities at the OS level but do not specifically capture detailed operations within containers, which are crucial for investigating cloud-native application compromises.
- C. Incorrect.
Kubernetes API server logs track interactions with the Kubernetes control plane, such as resource creation or modification, but they do not provide visibility into the activities happening within an individual container.
- D. Incorrect.
Virtual network flow logs provide insights into network traffic patterns but do not offer details about the actual actions or events occurring within the containerized application.