A company uses Amazon Elastic Kubernetes Service (Amazon EKS) clusters to run its Kubernetes-based applications. The company uses Amazon GuardDuty to protect the applications. EKS Protection is…

Question

Options

• AEnable VPC flow logs for the VPC that hosts the EKS clusters.
• BAssign the CloudWatchEventsFullAccess AWS managed policy to the EKS clusters.
• CEnsure that the AmazonGuardDutyFullAccess AWS managed policy is attached to the GuardDuty
• DEnable the control plane logs in Amazon EKS. Ensure that the logs are ingested into Amazon

• A
  4% (1)
• B
  9% (2)
• D
  87% (20)

Explanation

Option D is correct because GuardDuty's EKS Audit Log Monitoring feature works by analyzing EKS control plane logs - specifically the Kubernetes audit logs. If control plane logging isn't enabled in EKS and those logs aren't being sent to Amazon CloudWatch Logs, GuardDuty simply has no data source to analyze, rendering the feature inactive despite being "enabled."

Why the distractors fail:

• A - VPC flow logs capture network-level traffic, not Kubernetes API activity; GuardDuty EKS Protection doesn't use them as its monitoring source.
• B - Assigning CloudWatchEventsFullAccess to EKS clusters grants EventBridge/CloudWatch Events permissions, which has no bearing on enabling GuardDuty threat detection.
• C - GuardDuty operates via a service-linked role, not a managed policy attached to the service itself; this action changes nothing about what GuardDuty can observe.

Memory tip: Think of GuardDuty as a reader, not a collector - it can only detect threats in data that already exists. For EKS, that means you must first turn on the control plane logs (the audit trail of every Kubernetes API call) so GuardDuty has something to read. No logs = no monitoring, regardless of what's toggled in the GuardDuty console.

No community discussion yet for this question.