Câu 28: XSIAM-ENGINEER: Palo Alto Networks XSIAM Engineer

An engineer is conducting a threat actor emulated test to determine which Cortex XDR module would provide protection or alert on a real-world attack. The first test was prevented. Which action must the engineer take to enable continued testing?

1. A. Remove the hash from the restrictions profile.
2. B. Add an indicator exclusion. — đáp án hiện tại
3. C. Add a prevention rule.
4. D. Change the profile from "alert" to "prevent" for the BTP module.