Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsEasy
A security operations center (SOC) manager is evaluating Cortex XSOAR for a multi-tenant deployment to serve several distinct business units, each requiring strict data segregation and independent incident workflows. Which architectural component in Cortex XSOAR primarily facilitates this requirement?
- APlaybooks
- BTenants
- CIntegrations
- DEngines
Show answer & explanationAnswer & explanation
Correct answer: B. Tenants
Cortex XSOAR's multi-tenancy feature allows for the creation of isolated environments, known as tenants, where each business unit can manage its incidents, users, and data independently, ensuring strict data segregation.
Why the other options are wrong
- A. Playbooks automate incident response processes but operate within a tenant's context, not defining the tenancy itself.
- C. Integrations connect XSOAR to external systems but do not define the architectural separation for multiple business units.
- D. Engines extend XSOAR's capabilities to remote networks but do not provide logical separation for multi-tenancy.
Cortex XSOAR Multi-Tenancy
A feature in Cortex XSOAR that allows a single XSOAR instance to host multiple logically separated environments, called tenants, each with its own data, users, and configurations.
- Ensures strict data segregation between business units.
- Each tenant has independent incident management and user roles.
- Ideal for managed security service providers (MSSPs) or large enterprises with distinct departments.
Memory trick: Separate apartments in a single building, each with its own rules.