Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsMedium
A security administrator is setting up a new Cortex XSOAR environment and needs to ensure that critical incident data is always available, even if the primary XSOAR server experiences a complete failure. Which deployment model or feature should be prioritized to meet this high availability requirement?
- AMulti-tenant deployment with dedicated engines
- BSingle-server deployment with daily backups
- CHigh Availability (HA) cluster with an external database
- DCloud-based deployment with disaster recovery snapshots
Show answer & explanationAnswer & explanation
Correct answer: C. High Availability (HA) cluster with an external database
A High Availability (HA) cluster, typically configured with multiple XSOAR servers and an external database, ensures continuous operation and data replication, providing resilience against primary server failures.
Why the other options are wrong
- A. Multi-tenancy separates logical environments but does not inherently provide high availability for the underlying infrastructure.
- B. Daily backups aid disaster recovery but do not ensure continuous availability during a primary server failure.
- D. Cloud deployment offers inherent resilience but XSOAR's dedicated HA cluster is the specific feature for severe server failures regardless of deployment location.
Cortex XSOAR High Availability (HA)
A deployment configuration that uses redundant components to minimize downtime and ensure continuous operation of the Cortex XSOAR platform.
- Typically involves multiple XSOAR servers (active/standby or active/active).
- Requires an external, highly available database (e.g., PostgreSQL HA).
- Ensures automatic failover in case of a primary server failure.
Memory trick: Two engines running, one always ready to take over if the other stalls.