A Behavioral Threat Protection (BTP) alert is triggered with an action of "Prevented (Blocked)" on one of several application servers running Windows Server 2022. The investigation determines the involved processes to be legitimate core OS binaries, and the description from the triggered BTP rule is an acceptable risk for the company to allow the same activity in the future. This type of activity is only expected on the endpoints that are members of the endpoint group "AppServers," which already has a separate prevention policy rule with an exceptions profile named "Exceptions-AppServers" and a malware profile named "Malware-AppServers." The CGO that was terminated has the following properties: SHA256: eb71ea69dd19f728ab9240565e8c7efb59821e19e3788e289301e1e74940c208 File path: C:\Windows\System32\cmd.exe Digital Signer: Microsoft Corporation How should the exception be created so that it is scoped as narrowly as possible to minimize the security gap?
Select one answer.
AI Answer Explanation & Exam Tips
Instant breakdown of key concepts, distractor analysis, and quick exam memory tricks.
Purchase Full Access to view answer options & explanation
The first 112 questions in this bank are completely free. Unlock Full Access on the exam page to view all answer choices, verified answers, explanations, and community discussions for all 373 questions.
