An engineer is conducting a threat actor emulated test to determine which Cortex XDR module...

An engineer is conducting a threat actor emulated test to determine which Cortex XDR module would provide protection or alert on a real-world attack. The first test was prevented.

Which action must the engineer take to enable continued testing?

A Remove the hash from the restrictions profile

B. Add an indicator exclusion.

C. Add a prevention rule.

D. Change the profile from "alert" to "prevent" for the BTP module.