A logistics firm runs EKS, Lambda, and RDS across three Regions and must centralize API audit trails, Kubernetes control-plane logs, and database activity streams for threat hunting with 1-year retention. Which log source selection meets audit, container, and database coverage?
Select an answer to reveal the explanation.
Short Explanation
You can't hunt what you never collected, so cover all three layers. Coverage across API, container control plane, and database streams gives hunters full context.
Full Explanation
Organization CloudTrail provides API audit trails for management and data events, EKS control-plane logs capture authenticator and API server activity essential for container threat hunting, and RDS Enhanced Monitoring plus Database Activity Streams (supported on engines such as Aurora, RDS for Oracle and SQL Server, and delivered through Kinesis then Firehose to S3) capture OS and database-level activity, together centralized to S3 with lifecycle policies for one-year retention. Flow Logs plus DNS plus CDN logs give network visibility but miss API identity actions and database queries. Trusted Advisor, Cost Explorer, and Health provide hygiene and billing signals, not security telemetry. Inspector, GuardDuty, and Macie outputs are findings derived from logs, not the raw source logs needed for hunting. For the exam map CloudTrail to who-did-what, EKS logs to container control, activity streams to database, and practically validate central aggregation with organization trails, log delivery status, and Athena queries.