Palo Alto Networks XSIAM-Engineer Exam - Topic 2 Question 3 Discussion

Actual exam question for Palo Alto Networks's XSIAM-Engineer exam

Question #: 3
Topic #: 2

When Cortex XDR agents are on servers in a zone with no internet access, which configuration will keep them communicating with the platform?

ALogging service in the isolated zone

BBroker VM

CIntegration using filebeat

DEngine

Show Suggested Answer

Suggested Answer: B

For Cortex XDR agents running on servers in zones without internet access, a Broker VM is used as a communication bridge. The Broker VM securely relays traffic between the isolated agents and the Cortex platform, maintaining connectivity without requiring direct internet access from the servers.

by Romana at Nov 20, 2025, 01:25 PM

Limited Time Offer

25%

Off

Get Premium XSIAM-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Albert

1 day ago

I thought A) Logging service would work too.

upvoted 0 times

...

Precious

6 days ago

B) Broker VM is the way to go!

upvoted 0 times

...

Ronnie

12 days ago

Broker VM, the Swiss Army Knife of Cortex XDR communication. Genius!

upvoted 0 times

...

Leota

17 days ago

Broker VM, the MVP of isolated zone connectivity. Nailed it!

upvoted 0 times

...

Albina

22 days ago

A) Logging service in the isolated zone? Sounds like a recipe for disaster. Not the answer.

upvoted 0 times

...

Van

27 days ago

C) Integration using filebeat sounds like a creative solution, but it's not the right one for this scenario.

upvoted 0 times

...

Mitzie

1 month ago

D) Engine is the way to go. It's the heart of the Cortex XDR system, so it must be the answer.

upvoted 0 times

...

Vivan

1 month ago

I’m leaning towards the Broker VM too, but I’m not confident. I wish I had reviewed that section more thoroughly.

upvoted 0 times

...

Gerardo

1 month ago

I feel like we practiced a similar question, and I think the Engine was mentioned as a key component, but I could be mixing it up.

upvoted 0 times

...

Aliza

2 months ago

I remember something about the logging service, but I can't recall if it actually keeps the agents connected without internet access.

upvoted 0 times

...

Aretha

2 months ago

Engine? I'm not sure what that refers to in this context. I'll have to research that one a bit more.

upvoted 0 times

...

Michell

2 months ago

I'm leaning towards the Integration using filebeat choice. That seems like it could work for an isolated zone.

upvoted 0 times

...

Victor

2 months ago

I think the Broker VM might be the right choice since it helps with communication in isolated environments, but I'm not entirely sure.

upvoted 0 times

...

Claudia

2 months ago

Okay, let's see. I'm thinking the Broker VM might be the best option to keep the agents communicating without internet access.

upvoted 0 times

...

Na

3 months ago

B) Broker VM is the correct answer. It allows the Cortex XDR agents to communicate with the platform even in an isolated zone.

upvoted 0 times

...

Launa

3 months ago

I'm a bit confused by the wording here. Can the agents really not access the internet at all in this scenario?

upvoted 0 times

...

Leslee

3 months ago

Hmm, this looks like a tricky one. I'll need to think through the different options carefully.

upvoted 0 times

Quentin

2 months ago

But what about the logging service?

upvoted 0 times

...

Corrina

3 months ago

I think the Broker VM might be the key here.

upvoted 0 times

...