What will enable a custom prevention rule to block specific behavior?

Question

Options

• AA correlation rule added to an Agent Blocking profile
• BA custom behavioral indicator of compromise (BIOC) added to an Exploit profile
• CA custom behavioral indicator of compromise (BIOC) added to a Restriction profile
• DA correlation rule added to a Malware profile

• C
  94% (15)
• D
  6% (1)

Explanation

Option C is correct because a Restriction profile is the profile type designed to enforce blocking and prevention actions - pairing it with a custom BIOC lets you define the specific behavior to detect and have it actively blocked when triggered. Option A is wrong because correlation rules in an Agent Blocking profile are used for detection and alerting logic, not for custom behavioral prevention. Option B is wrong because Exploit profiles target exploit technique protections (e.g., heap spray, ROP), not general custom behavioral blocking, so a BIOC there won't serve as a prevention rule. Option D is wrong because Malware profiles handle file-based malware detection, and correlation rules don't function as behavioral blocking mechanisms regardless of the profile they're added to.

Memory tip: Link Restriction → Restrict/Block, and remember that BIOCs define the behavior to watch - so "custom behavior + blocking = BIOC in a Restriction profile." If a distractor uses "correlation rule," it's for detection, not prevention; if it uses "Exploit" or "Malware" profile, the scope is too narrow for general behavioral blocking.

No community discussion yet for this question.