VMware 5V0-91.20 - VMware Carbon Black Portfolio Skills Exam
Page: 3 / 12
Total 56 questions
Question #11 (Topic: Topic 1)
A security policy states to enable Live Response by default across the enterprise. However, the team identified critical systems which should not support Live
Response due to risk. The team needs to disable Live Response on selected systems.
From which page can this goal be accomplished?
Response due to risk. The team needs to disable Live Response on selected systems.
From which page can this goal be accomplished?
A. Policy
B. API Access
C. Endpoints
D. Roles
Answer: D
Question #12 (Topic: Topic 1)
An analyst is investigating a specific alert in Endpoint Standard. The analyst selects the investigate button from the alert triage page and sees the following:
[VMware-5V0-91.20-1.0/xmlfile-8_1.jpg]
Which statement accurately characterizes this situation?
[VMware-5V0-91.20-1.0/xmlfile-8_1.jpg]
Which statement accurately characterizes this situation?
A. These events are tied to an observed alert within the user interface.
B. The policy had no blocking and isolation rules set.
C. The events shown will all have the same event ID, correlating them to the alert.
D. Each event listed contributed to the overall alert score and severity.
Answer: D
Question #13 (Topic: Topic 1)
Examine the following EDR query:
file_desc:ג€Windows Command Processorג€ AND -process_name:cmd.exe
Which process will show in the query results?
file_desc:ג€Windows Command Processorג€ AND -process_name:cmd.exe
Which process will show in the query results?
A. Any process named something other than cmd.exe with the file description of ג€Windows Command Processorג€
B. Any process with the binary file description ג€Windows Command Processorג€
C. Any process with the binary file description ג€Windows Command Processorג€ named cmd.exe
D. Any process named cmd.exe
Answer: C
Question #14 (Topic: Topic 1)
Carbon Black App Control maintains an inventory of all interesting (executable) files on endpoints where the agent is installed.
What is the initial inventory procedure called, and how can this process be triggered?
What is the initial inventory procedure called, and how can this process be triggered?
A. Inventorying; enable Discovery mode
B. Baselining; install the agent
C. Discovery; place agent into Disabled mode
D. Initialization; move agent out of Disabled mode
Answer: A
Question #15 (Topic: Topic 1)
This search is entered into the process search page: notepad.exe
Which three statements about this query are true? (Choose three.)
Which three statements about this query are true? (Choose three.)
A. Only processes named notepad.exe will be returned.
B. Since a field name is not selected, query performance will be impacted.
C. A field identifier is required for all criteria within a process search.
D. The search will fail with an error.
E. All processes containing the text notepad.exe in any default field.
F. Processes with registry modifications containing notepad.exe would be retuned.
Answer: BEF
