How are dynamic endpoint groups created and managed in Cortex XDR?

Question

Options

• AEndpoint groups require intervention to update the group with new endpoints when a new device is
• BEach endpoint can belong to multiple groups simultaneously, allowing different security policies to
• CAfter an endpoint group is created, its assigned security policy cannot be changed without deleting
• DEndpoint groups are defined based on fields such as OS type, OS version, and network segment

• B
  4% (1)
• C
  8% (2)
• D
  88% (23)

Explanation

Option D is correct because Cortex XDR creates dynamic endpoint groups by automatically evaluating endpoints against criteria like OS type, OS version, IP range, or network segment - when an endpoint matches those criteria, it's added to the group automatically, with no manual intervention required.

• A is wrong because the whole point of dynamic groups is that they update automatically - no manual intervention is needed when a new device joins.
• B is wrong because in Cortex XDR, each endpoint belongs to only one endpoint group at a time; policy assignment is exclusive, not overlapping.
• C is wrong because security policies assigned to an endpoint group can be changed without deleting the group - groups and policies are managed independently.

Memory tip: Think of the word dynamic - the group dynamically reacts to endpoint attributes (OS, version, network). If you see criteria-based automatic membership, that's dynamic groups. "Dynamic = defined by data fields, not by manual lists."

No community discussion yet for this question.