Exam SecOps-Pro Topic 1 Question 4 Discussion

Actual exam question for Palo Alto Networks's SecOps-Pro exam
Question #: 4
Topic #: 1

A large software development company is migrating its critical applications to a cloud-native architecture, leveraging Kubernetes clusters and serverless functions. They use Cortex XDR for threat detection and response. An attacker attempts to exploit a misconfiguration in a Kubernetes pod to achieve container escape and then escalate privileges on the host node. Which of the following statements accurately describes how Cortex XDR's Log Stitching benefits this cloud-native environment investigation, specifically considering the ephemeral nature of containers?

A. Log Stitching automates the deployment of new, hardened container images to replace compromised ones immediately upon detecting an anomaly. B. Cortex XDR agents, leveraging Log Stitching, provide visibility only into the host OS, as container logs are too volatile to be stitched effectively. C. Log Stitching effectively correlates forensic data (e.g., process execution within containers, host-level process spawns, network traffic from the node, Kubernetes API calls) from both the ephemeral container and its underlying host, even after the compromised container has terminated, maintaining a persistent attack storyline across the cloud environment. D. Log Stitching in cloud environments is primarily used for cost optimization by identifying underutilized cloud resources. E. It translates all container-specific logs into a generic syslog format, making them easier for traditional SIEMs to ingest.

Suggested Answer: C Vote an answer

The ephemeral nature of containers poses a significant challenge for incident response. Log Stitching in Cortex XDR is critical here because it can collect and correlate data not just from the host, but also from within the containers themselves, and crucially, maintain this stitched storyline even if the container is terminated. This persistent visibility across host and container boundaries, linking Kubernetes API calls, container process activities, and host-level actions, allows security teams to reconstruct the full attack chain, from the initial pod compromise to host privilege escalation, even after the evidence inside the container is gone.

by Maria at May 18, 2026, 11:46 AM

Limited Time Offer

15%

Off

Get Premium SecOps-Pro Questions as Interactive Self Test Engine or PDF

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business