Which two alert notification options can be configured without creating a playbook? (Choose two.)

Which XQL clause is used to limit the number of returned results?

An administrator is preparing to activate a new Cortex XSIAM tenant and must ensure the data- at-rest encryption meets specific organization requirements.
At which stage of the deployment must the encryption method be selected?

A Behavioral Threat Protection (BTP) alert is triggered with an action of "Prevented (Blocked)" on one of several application servers running Windows Server 2022. The investigation determines the involved processes to be legitimate core OS binaries, and the description from the triggered BTP rule is an acceptable risk for the company to allow the same activity in the future.
This type of activity is only expected on the endpoints that are members of the endpoint group
"AppServers," which already has a separate prevention policy rule with an exceptions profile named "Exceptions-AppServers" and a malware profile named "Malware-AppServers." The CGO that was terminated has the following properties:
- SHA256:
eb71ea69dd19f728ab9240565e8c7efb59821e19e3788e289301e1e74940c208
- File path: C:\Windows\System32\cmd.exe
- Digital Signer: Microsoft Corporation
How should the exception be created so that it is scoped as narrowly as possible to minimize the security gap?

To simplify the configuration process, which field is automatically mapped from the dataset to the data model without requiring manual configuration?