A Cortex XSIAM engineer is implementing role-based access control (RBAC) and scope-based access control (SBAC) for users accessing the Cortex XSIAM tenant with the following requirements:
- Users managing machines in Europe should be able to manage and control all endpoints and installations, create profiles and policies, view alerts, and initiate Live Terminal, but only for endpoints in the Europe region.
- Users managing machines in Europe should not be able to create, modify, or delete new or existing user roles.
The Europe region endpoints are identified by both of the following:
- Endpoint Tag = "Europe-Servers" and Endpoint Group = "Europe" for servers in Europe
- Endpoint Group = "Europe" and Endpoint Tag = "Europe-Workstation" for workstations in Europe Which two sets of implementation actions should the engineer take? (Choose two.)

• A. Verify and confirm that SBAC mode under "Server Settings" is set to "Restrictive," and assign
  "EG:Europe" under the user permission scope configuration.
• B. Verify and confirm that SBAC mode under "Server Settings" is set to "Permissive," and assign
  "EG:Europe" under the user permission scope configuration.
• C. Use the pre-defined roles, assign the "Privileged IT Admin" role to the user or user group managing Europe-based endpoints.
• D. Use the pre-defined roles, assign the "Instance Administrator" role to the user or user group managing Europe-based endpoints.

A sub-playbook is configured to loop with a For Each Input. The following inputs are given to the sub-playbook:
Input x: W,X,Y,Z
Input y: a,b,c,d
Input z: 9
Which inputs will be used for the second iteration of the loop?

• A. X,b
• B. X,b,9
• C. X,b,c
• D. a,b,c,d

A Behavioral Threat Protection (BTP) alert is triggered with an action of "Prevented (Blocked)" on one of several application servers running Windows Server 2022. The investigation determines the involved processes to be legitimate core OS binaries, and the description from the triggered BTP rule is an acceptable risk for the company to allow the same activity in the future.
This type of activity is only expected on the endpoints that are members of the endpoint group
"AppServers," which already has a separate prevention policy rule with an exceptions profile named "Exceptions-AppServers" and a malware profile named "Malware-AppServers." The CGO that was terminated has the following properties:
- SHA256:
eb71ea69dd19f728ab9240565e8c7efb59821e19e3788e289301e1e74940c208
- File path: C:\Windows\System32\cmd.exe
- Digital Signer: Microsoft Corporation
How should the exception be created so that it is scoped as narrowly as possible to minimize the security gap?

• A. Create the exception via the alert itself, selecting the CGO hash, CGO signer, CGO process path, and applying the scope to "Global."
• B. Create the exception via the alert itself, selecting the CGO hash, CGO signer, CGO process path, and applying the scope to the "Exceptions-AppServers" profile.
• C. Create a Disable Prevention Rule via Exceptions Configuration with the following selections:
  
• D. Create a Legacy Agent Exception via Exceptions Configuration with the following selections:
  

What is the primary function of the URL "https://<region>-docker.pkg.dev" in the context of a Palo Alto Networks infrastructure?

• A. It downloads Engine Docker containers.
• B. It downloads Kubernetes images for agent installation.
• C. It imports Docker licensing.
• D. It downloads Docker content updates.