A file for a support exception that needs to be updated locally on a Linux endpoint has been supplied.
Which cytool command will upload this support exception file to the endpoint?

• A. cytool import suexfile -path </local/file/path>
• B. cytool upload suexfile -target </local/file/path>
• C. cytool upload suex -file </local/file/path>
• D. cytool import suex -path </local/file/path>

A Behavioral Threat Protection (BTP) alert is triggered with an action of "Prevented (Blocked)" on one of several application servers running Windows Server 2022. The investigation determines the involved processes to be legitimate core OS binaries, and the description from the triggered BTP rule is an acceptable risk for the company to allow the same activity in the future.
This type of activity is only expected on the endpoints that are members of the endpoint group
"AppServers," which already has a separate prevention policy rule with an exceptions profile named "Exceptions-AppServers" and a malware profile named "Malware-AppServers." The CGO that was terminated has the following properties:
- SHA256:
eb71ea69dd19f728ab9240565e8c7efb59821e19e3788e289301e1e74940c208
- File path: C:\Windows\System32\cmd.exe
- Digital Signer: Microsoft Corporation
How should the exception be created so that it is scoped as narrowly as possible to minimize the security gap?

• A. Create a Disable Prevention Rule via Exceptions Configuration with the following selections:
  
• B. Create the exception via the alert itself, selecting the CGO hash, CGO signer, CGO process path, and applying the scope to "Global."
• C. Create the exception via the alert itself, selecting the CGO hash, CGO signer, CGO process path, and applying the scope to the "Exceptions-AppServers" profile.
• D. Create a Legacy Agent Exception via Exceptions Configuration with the following selections:
  

Alert field mapping provides which two benefits in correlation rules? (Choose two.)

• A. It correlates alert data with other data sources.
• B. It contributes alert data to analytics baselines.
• C. It improves incident grouping logic.
• D. It lists the artifacts and assets in the incident.

What is the role of "in" in the query line below?
action_local_port in (1122, 2234)

• A. Function
• B. Range
• C. Operator
• D. Operand

An engineer wants to onboard data from a third-party vendor's firewall. There is no content pack available for it, so the engineer creates custom data source integration and parsing rules to generate a dataset with the firewall data.
How can the analytics capabilities of Cortex XSIAM be used on the data?

• A. Create a behavioral indicator of compromise (BIOC) rule on the network fields (source IP, source port, targe
• B. Create a correlation rule on the network fields (source IP, source port, target IP, target port, IP protocol).
• C. Create a data model rule with network fields mapped (source IP, source port, target IP, target port, IP protocol).
• D. Create a parsing rule and ensure the network fields exist (source IP, source port, target IP, target port, IP protocol).