XDR-ENGINEER practice question 2 of 10

[Cortex XDR Agent Configuration] A static endpoint group is created by adding 321 endpoints using the Upload From File feature. However, after group creation, the members count field shows 244 endpoints. What are two possible reasons why endpoints were not added to the group? (Choose two.)

Full set: 50 questions
Answer options
A: Static groups have a limit of 250 endpoints when adding by file
B: Endpoints added to the new group were previously added to an existing group
C: Endpoints added to the group were in Disconnected or Connection Lost status when groupmembership was added Correct answer
D: The IP address, hostname, or alias of the endpoints must match an existing agent that has registered with the tenant Correct answer
Correct Answer:
C. Endpoints added to the group were in Disconnected or Connection Lost status when groupmembership was added; D. The IP address, hostname, or alias of the endpoints must match an existing agent that has registered with the tenant
Explanation

When creating a static group by uploading a file, Cortex XDR attempts to match each entry (hostname, IP, or alias) in the file to an agent that has previously registered with the tenant. If an entry does not correspond to any known agent, it will be ignored. Similarly, if an agent has been uninstalled, its status becomes "Disconnected," and it is no longer a manageable endpoint. Such endpoints from the list would also fail to be added to the group.

Why Incorrect

A. Static groups support up to 50,000 endpoints; a limit of 250 is incorrect.
B. Endpoints can belong to multiple static groups simultaneously, so being in an existing group is not a reason for exclusion.

References

Palo Alto Networks Cortex XDR Administrator's Guide. "Create a Static Group of Endpoints." The documentation states, "Cortex XDR adds only endpoints that are already registered with Cortex XDR and that match the endpoint names, IP addresses, or aliases in the file." This directly supports option D.

Palo Alto Networks Cortex XDR Administrator's Guide. "Endpoint Statuses." The "Disconnected" status is defined for agents that have been uninstalled. An uninstalled agent is no longer managed and cannot be added to a group, supporting option C.

Scroll to Top