XSIAM-ENGINEER: Palo Alto Networks Certified XSIAM Engineer

By Palo Alto Networks · Question Mode

QuestionQ24

VerifiedMaintenance and Troubleshooting

An engineer is performing a threat-actor emulation test to identify which Cortex XDR module would protect against or alert on a real-world attack. The initial test was prevented.

Which action must the engineer take to continue the testing?

Explanation

An indicator exclusion exempts the known test indicator from enforcement, allowing the emulated attack sequence to continue and reveal protection or alerting by subsequent Cortex XDR modules. Restriction rules can otherwise block an executable before later test activity occurs.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!