XSIAM-ENGINEER · Question #10
A Cortex XSIAM engineer adds a disable injection and prevention rule for a specific running process. After an hour, the engineer disables the rule to reinstate the security capabilities, but the…
The correct answer is A. The engineer needs to restart the process to get back the security capabilities. When a disable injection and prevention rule is applied to a running process, the security capabilities are detached for the lifetime of that process. Even after disabling the rule, the capabilities are not reapplied automatically; the process must be restarted to restore…
Question
A Cortex XSIAM engineer adds a disable injection and prevention rule for a specific running process. After an hour, the engineer disables the rule to reinstate the security capabilities, but the capabilities are not applied. What is the explanation for this behavior?
Options
- AThe engineer needs to restart the process to get back the security capabilities.
- BThe engineer needs a support exception to get back the security capabilities.
- CThe engineer needs to wait for the time period configured in the rule to pass first.
- DThe engineer can disable the rule, but security capabilities are not applied to the process.
How the community answered
(30 responses)- A73% (22)
- B13% (4)
- C7% (2)
- D7% (2)
Explanation
When a disable injection and prevention rule is applied to a running process, the security capabilities are detached for the lifetime of that process. Even after disabling the rule, the capabilities are not reapplied automatically; the process must be restarted to restore security
Topics
Community Discussion
No community discussion yet for this question.