Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsMedium
A managed security service provider (MSSP) is onboarding several new clients, each requiring a dedicated, isolated XSOAR environment with separate incident data, user management, and content. The MSSP wants to achieve this while minimizing the number of physical XSOAR server deployments. Which XSOAR architectural concept allows for this isolation within a single XSOAR deployment?
- AMulti-tenancy
- BShared Content Packs
- CHigh Availability clusters
- DCortex XSOAR Engines
Show answer & explanationAnswer & explanation
Correct answer: A. Multi-tenancy
Multi-tenancy is specifically designed for scenarios like MSSPs, allowing a single XSOAR deployment to host multiple logically separated 'tenants' or 'accounts', each with its own isolated data, users, and configurations, thus meeting the isolation requirement while minimizing physical infrastructure.
Why the other options are wrong
- B. Shared content packs are for content distribution, not for isolating client data and users.
- C. HA clusters provide redundancy and uptime for a single XSOAR instance, not isolation for multiple clients.
- D. XSOAR Engines offload automation execution, they do not provide client isolation.
Cortex XSOAR Multi-tenancy
An architectural feature that enables a single XSOAR deployment to securely host multiple independent and isolated environments (tenants) for different organizations or departments.
- Each tenant has isolated incident data, users, and configurations.
- Commonly used by MSSPs to serve multiple clients.
- Minimizes infrastructure footprint while maintaining isolation.
Memory trick: Think of an apartment building (XSOAR) where each tenant (client) has their own locked apartment.