Exam XSIAM-Engineer Topic 1 Question 55 Discussion

Actual exam question for Palo Alto Networks's XSIAM-Engineer exam
Question #: 55
Topic #: 1

A security architect is designing a highly segmented network where critical servers have very limited outbound internet access, only to specific, whitelisted IP addresses/FQDNs for security updates and essential services. When planning the Cortex XSIAM agent deployment for these servers, what is the most robust and secure method to allow agent communication and updates, minimizing the attack surface?

A. Whitelist only the primary XSIAM cloud FQDN (e.g., api. xdr. paloaltonetworks. corn) on firewalls. The agent will handle all necessary sub-connections through this single endpoint. B. Deploy a dedicated XSIAM Broker in a DMZ, configured to act as a proxy. Only whitelist the Broker's IP address and port 443 on the critical servers' firewalls for outbound communication to the Broker. The Broker will then handle communication to the XSIAM cloud. C. Configure an HTTP proxy server within the secure enclave, and whitelist its 12 The agent will use this proxy for all communications. Ensure the proxy performs SSL inspection to secure traffic. D. Manually download agent content updates and push them to the critical servers using an internal software distribution system that is air-gapped from the internet. Disable all automatic agent updates. E. Whitelist all IP ranges published by Palo Alto Networks for XSIAM cloud services globally, along with DNS, NTP, and CRL/OCSP servers necessary for certificate validation.

Suggested Answer: B Vote an answer

Option B represents the most robust and secure method for highly segmented environments. The Cortex XSIAM Broker is specifically designed for such scenarios. It acts as a secure intermediary for agents, allowing critical servers to communicate only with the Broker (which sits in a less restricted zone, like a DMZ), rather than directly with the XSIAM cloud. The Broker then securely relays data to the cloud. This significantly minimizes the attack surface by reducing the number of external FQDNs/lPs that critical servers need to reach. Option A is incorrect as agents require access to multiple XSIAM FQDNs for different services (telemetry, content, updates, etc.). Option C uses a generic HTTP proxy, which may not be as optimized or secure as a dedicated XSIAM Broker. Option D is too manual for dynamic threats and updates. Option E involves whitelisting a very broad range of IPs, which goes against the principle of 'minimal outbound access' and increases the attack surface significantly, especially as cloud IPs can change.

by Lance at Sep 24, 2025, 08:45 PM

Limited Time Offer

15%

Off

Get Premium XSIAM-Engineer Questions as Interactive Self Test Engine or PDF

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business