Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsHard
A security architect is designing a Cortex XSOAR deployment for an organization with a strict requirement for data isolation between different business units, while still allowing a central security team to monitor high-level metrics across all units. Each business unit must have its own incident management, users, and content. Which XSOAR architectural concept best addresses this scenario?
- ACortex XSOAR High Availability cluster with separate user groups.
- BA single XSOAR instance with extensive Data Scopes.
- CCortex XSOAR Multi-tenancy with a managing tenant.
- DMultiple standalone XSOAR instances with a central SIEM.
Show answer & explanationAnswer & explanation
Correct answer: C. Cortex XSOAR Multi-tenancy with a managing tenant.
Cortex XSOAR Multi-tenancy with a managing tenant is designed for precisely this scenario. Each business unit can operate in its own isolated tenant for data, users, and content, while a designated 'managing tenant' (or 'global tenant') can be configured to aggregate and monitor high-level metrics from all subordinate tenants without compromising their isolation.
Why the other options are wrong
- A. An HA cluster ensures uptime for a single instance and separate user groups manage permissions within that instance, but neither provides the necessary isolation between business units.
- B. Extensive Data Scopes operate within a single tenant and cannot provide the complete data, user, and content isolation required between distinct business units.
- D. Multiple standalone instances would achieve isolation but would significantly increase management overhead and make central monitoring difficult without custom integrations.
XSOAR Managing Tenant
A special tenant in a multi-tenant XSOAR deployment that can centrally manage and monitor subordinate tenants, often used for global oversight without breaking isolation.
- Provides high-level visibility across multiple isolated tenants.
- Does not grant direct access to sensitive data in subordinate tenants.
- Facilitates centralized reporting and content sharing.
Memory trick: Think of a 'Head Office' (managing tenant) getting reports from separate 'Branch Offices' (subordinate tenants).