Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsMedium
A security team is evaluating Cortex XSOAR for its ability to maintain operations during a regional power outage that affects their primary data center. They need to ensure that their XSOAR instance, including all incident data and automations, can be restored to a fully operational state in a secondary, geographically distinct data center within a defined timeframe. Which XSOAR fundamental concept is most critical for addressing this scenario?
- AHigh Availability (HA)
- BRole-Based Access Control (RBAC)
- CDisaster Recovery (DR)
- DMulti-Tenancy
Show answer & explanationAnswer & explanation
Correct answer: C. Disaster Recovery (DR)
Disaster Recovery (DR) is the process of recovering and resuming business operations after a catastrophic event, such as a regional power outage affecting a primary data center. It focuses on restoring services in a secondary location.
Why the other options are wrong
- A. High Availability focuses on keeping services running within a single data center, not recovering from a regional outage.
- B. Role-Based Access Control manages user permissions and is unrelated to recovering from a data center outage.
- D. Multi-Tenancy allows multiple organizations to share an XSOAR instance but does not inherently provide disaster recovery capabilities.
Cortex XSOAR Disaster Recovery (DR)
The process and strategy for recovering Cortex XSOAR operations and data after a major outage or disaster affecting the primary deployment site.
- Involves a secondary, geographically separate site
- Focuses on data restoration and service resumption
- Includes RTO (Recovery Time Objective) and RPO (Recovery Point Objective)
Memory trick: HA keeps it up; DR brings it back from the dead.