Yes it’s possible.
In fact except if the subdomain is www, only the subdomain should be whitelisted by default (if the subdomain is www, all subdomains are whitelisted by default).
When filling the “Request Domain Approval” on the validator (https://dev.twitter.com/docs/cards/validation/validator), make sure that “Website Domain” is “X1.example.com” and not “example.com”.
