XSIAM-ENGINEER: Palo Alto Networks Certified XSIAM Engineer

By Palo Alto Networks · Question Mode

QuestionQ5

VerifiedPlanning and Installation

Administrators from Building 3 were added to Cortex XSIAM to perform limited functions on a subset of endpoints. Custom roles were created and assigned to the administrators to limit their permissions, but their access must also be restricted through the principle of least privilege based on the endpoints they are permitted to manage.

All endpoints belong to an endpoint group named "Building3," and some endpoints might also belong to other endpoint groups.

Which technical control will limit the administrators' ability to manage endpoints outside their area of responsibility while retaining visibility of Building 3's endpoints?

Explanation

Scope-Based Access Control (SBAC) scopes endpoint access through endpoint groups and tags. In Permissive Mode, access is allowed when a user has at least one scope tag that matches the relevant entity. Assigning the EG:Building3 scope therefore allows access to every endpoint in Building3, including endpoints that also have other endpoint-group memberships, while endpoints without the Building3 group remain outside the administrators’ scope.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!