Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsMedium
A security architect is designing a Cortex XSOAR deployment for an organization with a strict regulatory compliance requirement that mandates complete isolation of incident data between different departments. Each department must only view and manage its own incidents, users, and integrations. Which XSOAR feature is essential to meet this requirement?
- AUser Groups
- BData Scopes
- CRole-Based Access Control (RBAC)
- DMulti-tenancy
Show answer & explanationAnswer & explanation
Correct answer: D. Multi-tenancy
Multi-tenancy provides complete logical separation of data, incidents, users, and configurations between different tenants. This ensures that each department operates in its own isolated environment, fulfilling the strict isolation requirement.
Why the other options are wrong
- A. User groups organize users for permission assignment within a tenant but do not provide cross-departmental data isolation.
- B. Data Scopes limit visibility of specific data types within a single tenant, but do not provide complete isolation at the department level.
- C. RBAC controls what actions a user can perform, but not the complete isolation of data between distinct organizational units.
Cortex XSOAR Multi-tenancy
An architectural capability allowing a single XSOAR instance to host multiple logically isolated environments (tenants), each with its own data, users, and configurations.
- Provides complete data and operational isolation.
- Each tenant has its own incident data, users, integrations.
- Ideal for MSSPs or large enterprises with strict departmental separation.
Memory trick: Isolation means building walls and separate rooms for data, not just locks on doors.