Q6 — AWS SCS-C02 Ch.1

Question 6 of 100 | ← Chapter 1

A company uses AWS Organizations and has Amazon Elastic Kubernetes Service (Amazon EKS) clusters in many AWS accounts. A security engineer integrates Amazon EKS with AWS CloudTrail. The CloudTrail trails are stored in an Amazon S3 bucket in each account to monitor API calls. The security engineer observes that CloudTrail logs are not displaying Kubernetes pod creation events. What should the security engineer do to view the Kubernetes events from Amazon CloudWatch?

• A. Configure the EKS clusters to use private S3 VPC endpoints. Configure the S3 buckets for logging. ＆nbsp;
• B. Enable Kubernetes API server component logs for each cluster. ＆nbsp; ✓
• C. Enable cross-origin resource sharing (CORS) in the S3 bucket that is used for logging. ＆nbsp;
• D. Configure CloudWatch. View the events in the CloudWatch console.

Correct Answer: B. Enable Kubernetes API server component logs for each cluster. ＆nbsp;

Explanation

从题目描述中，我们知道公司使用了AWS Organizations，并且在多个AWS账户中使用了Amazon Elastic Kubernetes Service (Amazon EKS) 集群。安全工程师已经将Amazon EKS与AWS CloudTrail集成，CloudTrail的记录存储在每个账户的Amazon S3存储桶中，用于监控API调用。但是，安全工程师发现CloudTrail日志没有显示Kubernetes pod创建事件。 要解决这个问题并查看Kubernetes事件，我们需要关注的是如何确保Kubernetes的API服务器组件日志被启用。这是因为这些日志通常会包含Kubernetes pod创建和其他相关事件的信息。 A选项中提到的配置EKS集群使用私有的S3 VPC端点和配置S3存储桶进行日志记录，虽然是重要步骤，但并不直接解决事件显示问题。C选项中启用CORS设置也与事件查看无关。D选项描述了配置CloudWatch并在控制台中查看事件，虽然是一个好的操作，但并未直接解决日志不显示Kubernetes事件的根本问题。 因此，B选项是正确的行动方向，即启用每个集群的Kubernetes API服务器组件日志。这将确保记录包括Kubernetes pod创建等关键事件的信息，从而解决安全工程师面临的问题。