Which two conditions may justify creating an exclusion for an alert? (Choose two)

Creating an exclusion is a method for tuning the security policy to reduce alert fatigue from known, benign activities. An alert triggered by a trusted, internally developed application or a legitimate administrative script is a common candidate for an exclusion once it has been verified as safe. Similarly, authorized vulnerability scanners often generate activity that mimics attacks, triggering alerts. To allow security teams to perform these scans without generating a high volume of false positives, exclusions are created for the scanner's IP addresses or specific processes.

C. A confirmed malware execution is a true positive security incident that requires immediate remediation, not exclusion, which would ignore future instances.
D. A lateral movement attempt is a strong indicator of an active attacker in the network and must be investigated, not ignored via an exclusion.

1. Palo Alto Networks. (2023). Cortex XDR Prevention Administrator's Guide. "Create an Exception". This section explicitly states that exceptions are used to "allow trusted files or processes that are otherwise detected as malware" and to "fine-tune your security policy to reduce the number of false positives."

2. Palo Alto Networks. (2023). Cortex XDR Administrator's Guide. "Manage Alerts". The documentation describes the workflow for handling alerts, including marking them as false positives and creating exceptions for legitimate activity to prevent future alerts. This applies to trusted internal processes and authorized scanning tools.