An administrator needs to configure secure access to the Cortex XSIAM web console for remote administrators. Which TWO security controls should be implemented? (Choose two)
Restricting console reachability by source address, either through IP allowlisting or IdP/SAML conditional access, blocks unauthenticated or unexpected networks from reaching the Cortex XSIAM web interface, directly limiting the remote administrator attack surface the scenario describes.
Why this answer
Option A is correct because configuring IP allowlisting policies or conditional access rules through the IdP/SAML configuration restricts console access to trusted networks or verified identity-provider conditions, adding a strong network- and identity-based control for remote administrators. Option C is correct because enforcing MFA for all administrator accounts adds a critical authentication factor, ensuring that stolen or guessed credentials alone cannot grant access to the Cortex XSIAM web console. Option B is wrong because disabling TLS encryption would expose credentials and session data to interception, directly undermining secure access.
Option D is wrong because publishing credentials in plaintext violates basic credential-handling and confidentiality principles. Option E is wrong because granting guest accounts unrestricted superuser privileges violates least privilege and would create a severe access-control risk.
Exam trap
The trap is that some distractors are obviously insecure (plaintext credentials, disabled TLS, guest superusers), but candidates may be tempted by 'speed up login times' or 'easy team reference' justifications that sound operationally convenient but violate security fundamentals.