Paloalto Networks Security Operations XDR-Engineer Question # 7 Topic 1 Discussion

In Cortex XDR,static endpoint groupsare manually defined groups of endpoints, often created by uploading a file containing endpoint identifiers (e.g., IP addresses, hostnames, or aliases) using theUpload From Filefeature. If fewer endpoints are added to the group than expected (e.g., 244 instead of 321), there are several possible reasons related to endpoint status or registration.

Correct Answer Analysis (C, D):

**C. Endpoints added to the group were in Disconnected or Connection Lost status when groupstatus when group membership was added: If endpoints are in aDisconnectedorConnection Loststatus (i.e., not actively communicating with the Cortex XDR tenant), they may not be successfully added to the group, as Cortex XDR requires active registration to validate and process group membership.

D. The IP address, hostname, or alias of the endpoints must match an existing agent that has registered with the tenant: For endpoints to be added to a static group, their identifiers (IP address, hostname, or alias) in the uploaded file must correspond to agents that are registered with the Cortex XDR tenant. If the identifiers do not match registered agents, those endpoints will not be added to the group.

Why not the other options?

A. Static groups have a limit of 250 endpoints when adding by file: There is no documented limit of 250 endpoints for static groups in Cortex XDR when using the Upload From File feature. The platform supports large numbers of endpoints in groups, and this is not a valid reason.

B. Endpoints added to the new group were previously added to an existing group: In Cortex XDR, endpoints are assigned to a single group for policy application to avoid conflicts, but this does not prevent endpoints from being added to a new static group during creation. The issue lies in registration or connectivity, not prior group membership.

Exact Extract or Reference:

TheCortex XDR Documentation Portalexplains endpoint group management: “Endpoints must be registered and actively connected to the tenant to be added to static groups. Unregistered or disconnected endpoints may not be included in the group” (paraphrased from the Endpoint Management section). TheEDU-260: Cortex XDR Prevention and Deploymentcourse covers group creation, stating that “static groups require valid, registered endpoint identifiers, and disconnected endpoints may not be added” (paraphrased from course materials). ThePalo Alto Networks Certified XDR Engineer datasheetincludes “Cortex XDR agent configuration” as a key exam topic, encompassing endpoint group management.