单选题

Based on the exhibit, which statement about this treat hunting query is true?

Create a new exception and share it with other organizations.

Create a new exception and assign it globally to all organizations.

Create a separate exception policy for each organization hosted on FortiEDR

Create a new exception and apply it to multiple organizations

The playbook execution pauses and requires administrator intervention.

The playbook execution stops because the action fails.

The playbook continues and executes the second action.

The playbook generates a notification email and execution stops.

The incident was archived from the console unhandled

A rule assigned action is set to block but the policy is in simulation mode.

The incident was handled automatically by the communication control policy.

The incident has not been handled by a console administrator.

Exclude app.exe whenever it appears.

Exclude all files in C:\Tools\

Exclude only signed versions of app.exe.

Exclude only app.exe when it is running from C:\Tools\

Core

Central manager

Reputation Server

Aggregator

The playbook isolates the device and generates a success status.

The playbook isolates the device and generates a fail status.

The playbook stops execution and generates a fail status

The playbook pauses execution and generates a pending status.

Update the authorization credentials in the API header.

Set the target collector group parameter to Engineering group.

Change the HTTP method in the request from PUT to POST.

Set the organization parameter to Default

The decision depends only on asset criticality, not scores.

The application with the Medium vulnerability score and ACI evidence should be addressed first.

The application with the Critical vulnerability score should be addressed first

Both applications should be treated equally because patching is necessary.