U.S. Independence Day Deal! Unlock 25% OFF Today – Limited-Time Offer - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Palo Alto Networks XDR-Engineer Exam - Topic 3 Question 3 Discussion

[Detection Engineering]A Custom Prevention rule that was determined to be a false positive alert needs to be tuned. The behavior was determined to be authorized and expected on the affected endpoint. Based on the image below, which two steps could be taken? (Choose two.)[Image description: A Custom Prevention rule configuration, assumed to trigger a Behavioral Indicator of Compromise (BIOC) alert for authorized behavior]
A) Apply an alert exception and B) Apply an alert exclusion to the XDR behavioral indicator of compromise (BIOC) alert
C) Apply an alert exclusion to the XDR agent alert
D) Modify the behavioral indicator of compromise (BIOC) logic

Palo Alto Networks XDR-Engineer Exam - Topic 3 Question 3 Discussion

Actual exam question for Palo Alto Networks's XDR-Engineer exam
Question #: 3
Topic #: 3
[All XDR-Engineer Questions]

[Detection Engineering]

A Custom Prevention rule that was determined to be a false positive alert needs to be tuned. The behavior was determined to be authorized and expected on the affected endpoint. Based on the image below, which two steps could be taken? (Choose two.)

[Image description: A Custom Prevention rule configuration, assumed to trigger a Behavioral Indicator of Compromise (BIOC) alert for authorized behavior]

Show Suggested Answer Hide Answer
Suggested Answer: A, B

by Wilburn at Jun 12, 2025, 10:28 PM

Limited Time Offer

25%

Off

Get Premium XDR-Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Lacresha
6 months ago
A and C seem like the safest choices here.
upvoted 0 times
...
Aracelis
6 months ago
Surprised that tuning is even needed for authorized behavior!
upvoted 0 times
...
Emeline
7 months ago
I think D could be a better option.
upvoted 0 times
...
Solange
7 months ago
Not sure about B, feels like it might miss something important.
upvoted 0 times
...
Dorthy
7 months ago
Definitely go with A and B!
upvoted 0 times
...
Kirk
7 months ago
I feel like both applying an alert exclusion and modifying the logic could work, but I need to double-check which one is more appropriate for this scenario.
upvoted 0 times
...
Latricia
8 months ago
I'm a bit confused about whether modifying the BIOC logic is necessary. Wouldn't that be more complicated than just excluding the alert?
upvoted 0 times
...
Luther
8 months ago
I remember a similar practice question where we had to exclude alerts, so maybe applying an alert exclusion to the BIOC alert is a good choice here.
upvoted 0 times
...
Kati
8 months ago
I think applying an alert exception could be one option, but I'm not entirely sure if that's the best approach for a false positive.
upvoted 0 times
...
Lashaun
8 months ago
I'm a little confused on the difference between an alert exception and an alert exclusion. I'll need to double-check the definitions to make sure I select the right option here.
upvoted 0 times
...
Sharmaine
8 months ago
Okay, let's think this through step-by-step. Since the behavior was determined to be authorized, I'd start by applying an alert exception. If that doesn't work, then modifying the BIOC logic could be the next step to fine-tune the rule.
upvoted 0 times
...
Viki
8 months ago
Hmm, I'm a bit unsure here. I know we need to address the false positive, but I'm not sure if I should apply an exception or exclusion. Maybe I'll review the details of each option to decide the best approach.
upvoted 0 times
...
Aaron
9 months ago
This looks straightforward. I'd go with applying an alert exception or modifying the BIOC logic to tune the rule and prevent future false positives.
upvoted 0 times
...
Jamal
11 months ago
I'm with Junita on this one. A) and B) are the cleanest solutions. Plus, who wants to mess with the BIOC logic if you don't have to?
upvoted 0 times
Yoko
11 months ago
Yeah, I think those are the safest choices. Modifying the BIOC logic could cause more issues.
upvoted 0 times
...
Derrick
11 months ago
I agree, A) Apply an alert exception and B) Apply an alert exclusion seem like the best options.
upvoted 0 times
...
...
Jani
11 months ago
Hah, these XDR agents, always causing trouble! A) and C) are the obvious choices here. No need to get your hands dirty with the BIOC logic.
upvoted 0 times
Ronna
10 months ago
Yeah, no need to mess with the BIOC logic. Those XDR agents can be a pain sometimes.
upvoted 0 times
...
Rima
10 months ago
I agree, A) Apply an alert exception and C) Apply an alert exclusion to the XDR agent alert are the way to go.
upvoted 0 times
...
...
Ricarda
12 months ago
D) is a bit overkill for a simple false positive, don't you think? A) and C) are the way to go in my opinion.
upvoted 0 times
Erasmo
11 months ago
Definitely, D) seems like it would be too drastic. A) and C) are the more reasonable choices.
upvoted 0 times
...
Loren
11 months ago
Yeah, I think A) and C) are the more practical options in this case.
upvoted 0 times
...
Marguerita
11 months ago
I agree, D) does seem like too much for just a false positive. A) and C) should do the trick.
upvoted 0 times
...
...
Bernadine
12 months ago
I believe modifying the behavioral indicator of compromise logic could also be helpful in this situation.
upvoted 0 times
...
Verlene
12 months ago
I agree with Suzan. Applying an alert exception seems like the right step.
upvoted 0 times
...
Suzan
12 months ago
I think we should apply an alert exception.
upvoted 0 times
...
Junita
1 year ago
Definitely go with A) and B). Applying an alert exception and exclusion is the way to go here. Don't want those false positives cluttering up my alerts!
upvoted 0 times
Janna
11 months ago
I always make sure to adjust the rules to avoid unnecessary alerts.
upvoted 0 times
...
Tijuana
11 months ago
It's important to tune those false positives to keep the alerts clean.
upvoted 0 times
...
Mitzie
1 year ago
I agree, applying an alert exception and exclusion is the best approach.
upvoted 0 times
...
...

Save Cancel