XDR-ENGINEER practice question 8 of 10

[Detection Engineering] What will enable a custom prevention rule to block specific behavior?

Full set: 50 questions

Answer options

A: A correlation rule added to an Agent Blocking profile

B: A custom behavioral indicator of compromise (BIOC) added to an Exploit profile

C: A custom behavioral indicator of compromise (BIOC) added to a Restriction profile Correct answer

D: A correlation rule added to a Malware profile

Correct Answer:

C. A custom behavioral indicator of compromise (BIOC) added to a Restriction profile

Explanation

To block behavior you must turn the BIOC into a prevention rule by attaching it to a Restriction profile; when that profile is assigned, the agent enforces the BIOC in “Prevent” mode and the unwanted behavior is blocked.

Why Incorrect

A. Correlation rules work on incidents, not on-agent prevention.
B. BIOCs in an Exploit profile raise exploit alerts; they do not act as prevention.
D. Malware profiles handle signature and WildFire malware verdicts, not behavioral BIOCs.

References

1. Palo Alto Networks, “Cortex XDR Administrator’s Guide 3.9”, ch. Endpoint Administration → Create BIOC Rules → Add BIOC to a Restriction Profile, pp. 554-556.

2. Palo Alto Networks TechDocs, “Create a Restriction Profile for Behavioral Protection”, rev. 2023-10-11.

Keep practicing

Take the free XDR-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test