Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsEasy
A security operations center (SOC) manager is evaluating Cortex XSOAR deployment options for a new, highly sensitive environment where all data must reside within the organization's private network, and direct internet access from the XSOAR instance is strictly prohibited. Which deployment model best meets these requirements?
- ACortex XSOAR SaaS
- BCortex XSOAR On-premises
- CCortex XSOAR Hybrid Cloud
- DCortex XSOAR Cloud with Private Link
Show answer & explanationAnswer & explanation
Correct answer: B. Cortex XSOAR On-premises
For environments with strict data residency and no internet access requirements, an on-premises deployment ensures complete control over the infrastructure and data. This model allows the organization to host XSOAR within its own private network.
Why the other options are wrong
- A. SaaS deployments are hosted by Palo Alto Networks, which violates the private network and data residency requirements.
- C. Hybrid cloud still involves some components in a public cloud, which is not suitable for a 'strictly prohibited' internet access environment.
- D. While private link offers secure connectivity, the XSOAR instance itself would still be cloud-hosted, violating the requirement for all data to reside within the organization's private network.
Cortex XSOAR On-premises Deployment
An XSOAR deployment model where the entire platform is installed and managed within the customer's own data center or private cloud infrastructure.
- Full control over data residency and network access.
- Requires customer to manage infrastructure and updates.
- Ideal for strict compliance and disconnected environments.
Memory trick: Think 'Home' for full control, 'Cloud' for ease, 'Hybrid' for a mix, and 'Link' for secure cloud access.