Palo Alto Networks XSIAM-Engineer Exam - Topic 2 Question 3 Discussion

Actual exam question for Palo Alto Networks's XSIAM-Engineer exam

Question #: 3
Topic #: 2

When Cortex XDR agents are on servers in a zone with no internet access, which configuration will keep them communicating with the platform?

ALogging service in the isolated zone

BBroker VM

CIntegration using filebeat

DEngine

Show Suggested Answer

Suggested Answer: B

For Cortex XDR agents running on servers in zones without internet access, a Broker VM is used as a communication bridge. The Broker VM securely relays traffic between the isolated agents and the Cortex platform, maintaining connectivity without requiring direct internet access from the servers.

by Romana at Nov 20, 2025, 01:25 PM

Limited Time Offer

25%

Off

Get Premium XSIAM-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Chandra

3 days ago

I’m leaning towards B as well. It makes sense for communication.

upvoted 0 times

...

Svetlana

9 days ago

A seems reasonable too.

upvoted 0 times

...

Stevie

14 days ago

I think B is the best choice.

upvoted 0 times

...

Judy

19 days ago

I’m not so sure about that, isn’t there a risk with the Broker VM?

upvoted 0 times

...

My

24 days ago

Definitely B, it’s the best option here.

upvoted 0 times

...

Rebecka

29 days ago

Wait, can we really use a Broker VM in an isolated zone?

upvoted 0 times

...

Albert

2 months ago

I thought A) Logging service would work too.

upvoted 0 times

...

Precious

2 months ago

B) Broker VM is the way to go!

upvoted 0 times

...

Ronnie

2 months ago

Broker VM, the Swiss Army Knife of Cortex XDR communication. Genius!

upvoted 0 times

...

Leota

2 months ago

Broker VM, the MVP of isolated zone connectivity. Nailed it!

upvoted 0 times

...

Albina

2 months ago

A) Logging service in the isolated zone? Sounds like a recipe for disaster. Not the answer.

upvoted 0 times

...

Van

2 months ago

C) Integration using filebeat sounds like a creative solution, but it's not the right one for this scenario.

upvoted 0 times

...

Mitzie

3 months ago

D) Engine is the way to go. It's the heart of the Cortex XDR system, so it must be the answer.

upvoted 0 times

...

Vivan

3 months ago

I’m leaning towards the Broker VM too, but I’m not confident. I wish I had reviewed that section more thoroughly.

upvoted 0 times

...

Gerardo

3 months ago

I feel like we practiced a similar question, and I think the Engine was mentioned as a key component, but I could be mixing it up.

upvoted 0 times

...

Aliza

3 months ago

I remember something about the logging service, but I can't recall if it actually keeps the agents connected without internet access.

upvoted 0 times

...

Aretha

3 months ago

Engine? I'm not sure what that refers to in this context. I'll have to research that one a bit more.

upvoted 0 times

...

Michell

3 months ago

I'm leaning towards the Integration using filebeat choice. That seems like it could work for an isolated zone.

upvoted 0 times

...

Victor

4 months ago

I think the Broker VM might be the right choice since it helps with communication in isolated environments, but I'm not entirely sure.

upvoted 0 times

...

Claudia

4 months ago

Okay, let's see. I'm thinking the Broker VM might be the best option to keep the agents communicating without internet access.

upvoted 0 times

...

Na

4 months ago

B) Broker VM is the correct answer. It allows the Cortex XDR agents to communicate with the platform even in an isolated zone.

upvoted 0 times

...

Launa

5 months ago

I'm a bit confused by the wording here. Can the agents really not access the internet at all in this scenario?

upvoted 0 times

...

Leslee

5 months ago

Hmm, this looks like a tricky one. I'll need to think through the different options carefully.

upvoted 0 times

Quentin

4 months ago

But what about the logging service?

upvoted 0 times

...

Corrina

4 months ago

I think the Broker VM might be the key here.

upvoted 0 times

...