An engineer needs to migrate Cortex XDR agents without internet connection from Cortex XSIAM tenant A to Cortex XSIAM tenant B. There is a broker configured for each tenant. This is the communication flow: XDR agents Broker A XSIAM tenant A XDR agents Broker B XSIAM tenant B Which two steps should be taken before moving the agents? (Choose two.)

Before migration, the endpoints must have a path to the new tenant.
1) Deploy a new Broker VM (Broker C) and register it to Cortex XSIAM tenant B (option B); this provides a local connection for the offline agents to the target tenant.
2) From tenant A’s console, edit the selected endpoints and add Broker C as an additional proxy (option D). When the agents receive this setting, they begin communicating through Broker C to tenant B, after which they can be reassigned. A Broker VM can be registered to only one tenant, so re-registering Broker A or installing Broker C in tenant A does not satisfy the requirement.

A. Registers Broker C to tenant A; does not create a communication path to tenant B for migration.
C. A Broker VM can only be registered to one tenant; adding Broker A to tenant B breaks its current registration.

1. Palo Alto Networks, “Cortex XSIAM Broker VM Guide” v2.4, Section ‘Register a Broker VM’, p. 7: “A Broker VM can be registered to only one Cortex tenant at a time.”

2. Palo Alto Networks, “Cortex XSIAM Administrator Guide” (2023-10), Chapter ‘Reassign Cortex Agents to a Different Tenant’, Steps 1-3, pp. 312-314.

3. Palo Alto Networks, “Configure Endpoint Proxies”, Cortex XSIAM Online Help, paragraph ‘Add a new proxy to existing endpoints’ (accessed 2025-11-29).