Which statement applies to the malware protection flow in Cortex XDR Prevent?

An Administrator is alerted to a Suspicious Process Creation security event from multiple users.
The users believe that these events are false positives Which two steps should the administrator take to confirm the false positives and create an exception? (Choose two )

What method does the Traps agent use to identify malware during a scheduled scan?

How do sub-playbooks affect the Incident Context Data?

Which two entities can be created as a behavioral indicator of compromise (BIOC)? (Choose two.)