During the deployment of a Broker VM in a high availability (HA) environment, after configuring...

In a high availability (HA) environment, theBroker VMin Cortex XDR acts as a local proxy to facilitate agent communications, content caching, and installer distribution, reducing dependency on direct cloud connections. To ensureagent installer availabilityandefficient content cachingacross failovers, the Broker VM must be configured to handle agent requests consistently, even if one VM fails. This requires proper SSL certificate management and load balancing to distribute traffic across multiple Broker VMs.

Correct Answer Analysis (B):The engineer shouldupload the signed SSL server certificate and keyto each Broker VM to secure communications and ensure trust between agents and the Broker VMs. Additionally, deploying aload balancerin front of the Broker VMs allows traffic to be distributed across multiple VMs, ensuring availability and performance consistency during failovers. The load balancer uses the configured Broker VM FQDN to route agent requests, and the signed SSL certificate ensures secure, uninterrupted communication. This setup supports content caching and installer distribution by maintaining a stable connection point for agents.

Why not the other options?

A. Use shared SSL certificates and keys for all Broker VMs and configure a single IP address for failover: While shared SSL certificates can be used, configuring a single IP address for failover (e.g., via VRRP or a floating IP) is less flexible than a load balancer and may not efficiently handle content caching or installer distribution across multiple VMs. Load balancers are preferred for HA setups in Cortex XDR.

C. Deploy a load balancer and configure SSL termination at the load balancer: SSL termination at the load balancer means the load balancer decrypts traffic before forwarding it to the Broker VMs, requiring unencrypted communication between the load balancer and VMs. This is not recommended for Cortex XDR, as Broker VMs require end-to-end SSL encryption for security, and SSL termination complicates certificate management.

D. Enable synchronized session persistence across Broker VMs and use a self-signed certificate and key: Self-signed certificates are not recommended for production HA environments, as they can cause trust issues with agents and require manual configuration. Synchronized session persistence is not a standard feature for Broker VMs and is unnecessary for content caching or installer availability.

Exact Extract or Reference:

TheCortex XDR Documentation Portaldescribes Broker VM HA configuration: “For high availability, deploy multiple Broker VMs behind a load balancer and upload a signed SSL server certificate and key to each VM to secure agent communications” (paraphrased from the Broker VM Deployment section). TheEDU-260: Cortex XDR Prevention and Deploymentcourse covers Broker VM setup, stating that “a load balancer with signed SSL certificates ensures agent installer availability and content caching in HA environments” (paraphrased from course materials). ThePalo Alto Networks Certified XDR Engineer datasheetincludes “planning and installation” as a key exam topic, encompassing Broker VM deployment for HA.