Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsHard
A cybersecurity incident response team is using Cortex XSOAR to manage their security operations. They need to ensure that their XSOAR deployment is resilient to hardware failures and can quickly recover from unexpected outages without significant data loss. To achieve this, regular backups of the XSOAR database and configuration files are performed. What is the most crucial aspect of these backups in the context of XSOAR's disaster recovery strategy?
- AEncrypting the backup files with a strong password.
- BEnsuring backups are stored off-site and tested regularly.
- CStoring backups on the same server as the XSOAR instance.
- DAutomating the backup process to run daily.
Show answer & explanationAnswer & explanation
Correct answer: B. Ensuring backups are stored off-site and tested regularly.
For a robust disaster recovery strategy, backups must be stored off-site (separate geographical location) to protect against a site-wide disaster. Regular testing ensures that the backups are restorable and meet the Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
Why the other options are wrong
- A. Encryption is important for security, but not the most crucial aspect for disaster recovery effectiveness.
- C. Storing backups on the same server defeats the purpose of disaster recovery, as a server failure would destroy both the instance and its backups.
- D. Automation is good practice, but the location and testability are more critical for actual disaster recovery.
Cortex XSOAR Disaster Recovery Best Practices
Key practices for XSOAR DR include regular, off-site, and tested backups, along with a documented recovery plan.
- Backups must be off-site
- Regularly test restore procedures
- Document RTO/RPO
Memory trick: Backups must be 'Off-Site and Tested' to truly survive.