300-215 Question 90
Single answerYour organization uses a cloud-native application hosted on a Kubernetes cluster. During a security incident, you are tasked with investigating unusual traffic patterns originating from one of the application pods. Which log source would provide the most relevant information to identify potential malicious activity within the application?
- A
Kubernetes API server audit logs
- B
Application container logs
- C
Ingress controller logs
- D
Pod resource usage metrics
Show answer and explanation
Correct answer: B
Explanation
Application container logs are the most relevant in this scenario because they provide detailed information about the application's internal operations, requests, and responses. By analyzing these logs, you can trace the source of unusual traffic patterns and identify potential malicious activity. While other log sources can provide supplementary information, they are not as directly useful for investigating this specific issue.
- A. Incorrect.
Kubernetes API server audit logs record API requests made to the Kubernetes cluster but do not provide detailed information about the application's internal behavior or network traffic.
- B. Correct.
Application container logs capture the specific activities of the application running inside the container, including requests, errors, and potentially malicious inputs. These are the most relevant logs for identifying unusual traffic patterns originating from the application.
- C. Incorrect.
Ingress controller logs provide information about external HTTP/S traffic entering the Kubernetes cluster but may not offer detailed insights into the application’s internal behavior or the source of the unusual traffic.
- D. Incorrect.
Pod resource usage metrics, such as CPU and memory usage, are useful for performance monitoring but do not contain detailed application-level activity or traffic data.