Exam CCSK topic 1 question 2 discussion

Cloud providers typically offer some level of logging, but there may be gaps due to service limitations, lack of visibility into certain layers, or provider restrictions. To address these gaps, organizations should enhance their logging capabilities by: Deploying their own logging agents (e.g., AWS CloudTrail, Azure Monitor, Google Cloud Logging). Using third-party SIEM solutions to aggregate and analyze logs. Implementing custom monitoring tools at the application, network, or host level.

C. You can instrument the technology stack with your own logging. If there are gaps in network logging data provided by the cloud provider, one option is to instrument your own technology stack with additional logging capabilities. This involves implementing logging mechanisms within your applications, systems, or network infrastructure to capture the desired data. By instrumenting your technology stack with your own logging, you can collect the specific information you need for monitoring, troubleshooting, and security purposes. This gives you more control over the logging process and allows you to fill in any gaps in the network logging data provided by the cloud provider. It's important to note that the cloud provider may have limitations or restrictions on certain aspects of logging due to security or privacy considerations. In such cases, you may need to work with the cloud provider to find an acceptable solution that meets your logging requirements while adhering to their policies.

> Where there are gaps you can sometimes instrument the technology stack with your own logging. This can work within instances, containers, and application code in order to gain telemetry important for the investigation. Pay particular attention to PaaS and serverless application architectures; you will likely need to add custom application-level logging.

Security Guidance page 105

Not sure what "instrument" in this context means? "Augment" could be a better word here.

Correct anwser