5V0-91.20無料問題集「VMware Carbon Black Portfolio Skills」

質問 1

How is a new Alert of type Event Alert created whenever an endpoint is added or deleted and send emails for the App Control admin whenever these events occur?

（A）Add filter in Event Properties for Subtype Computer added and Computer deleted. Add the App Control admin email, and then click Create & Exit.

（B）Add filter in Event Properties for Subtype Endpoint added and Endpoint deleted. Click Create and add the App Control admin email, and then click Create &. Exit.

（C）Add filter in Event Properties for Subtype Computer modified. Add the App Control admin email, and then click Create & Exit.

（D）Add filter in Event Properties for Subtype Computer added and Computer deleted. Click Create and add the App Control admin email, and then click Create & Exit.

正解：C 解答を投票する

質問 2

A process is writing numerous interesting files that never actually execute.
Which rule type can the administrator define that will prevent reporting these file creations?

（A）File Creation Control (Suppress)

（B）Execute Ignore

（C）Performance Optimization

（D）Expert (Tag Process, Terminate Process)

正解：C 解答を投票する

質問 3

An administrator receives an alert with the TTP DATA_TO_ENCRYPTION.
What is known about the alert based on this TTP even if other parts of the alert are unknown?

（A）A process attempted to delete encrypted data on the disk.

（B）A process attempted to write a file to the disk.

（C）A process attempted to modify a monitored file written by the sensor.

（D）A process attempted to transfer encrypted data on the disk over the network.

正解：B 解答を投票する

質問 4

An administrator is interested in upgrading endpoints to the latest release in VMware Carbon Black App Control (V8.1.4+).
What is the first step to make a new agent available for installation or upgrade?

（A）Download from the Carbon Black Cloud Back End

（B）Download from the Carbon Black App Control Server

（C）Download from the Carbon Black Software Reputation Service (SRS)

（D）Download from the Carbon Black User Exchange

正解：A 解答を投票する

質問 5

An Enterprise EDR administrator has created a custom Watchlist and wants to add a custom query to a report in the custom Watchlist.
From which page can the administrator add this custom query?

（A）Investigate

（B）Cloud Analysis

（C）Policies

（D）Watchlists

正解：A 解答を投票する

質問 6

Review the following search:
childproc_name:"rundll32.exe" AND -digsig_result:"Signed" AND path:c:\windows\* What is this search looking for?

（A）Processes launching rundll32.exe running out of the windows directory that are not signed

（B）Instances of rundll32.exe running out of the windows directory that are signed

（C）Instances of rundll32.exe running out of the windows directory that are not signed

（D）Processes being launched by rundll32.exe running out of the windows directory that are not signed

正解：D 解答を投票する

質問 7

There is a requirement to block ransomware when a sensor is offline.
Which blocking and isolation rule fulfills this requirement?

（A）Not Listed Application -> Performs ransomware-like behavior -> Deny operation

（B）Suspect Malware -> Performs ransomware-like behavior -> Deny operation

（C）Unknown Application -> Performs ransomware-like behavior -> Terminate process

（D）Known Malware -> Performs ransomware-like behavior -> Terminate process

正解：D 解答を投票する

質問 8

Which Sensor Status under Endpoint Health indicates that a system's policy enforcement is disabled, and the sensor is not sending security event data to the cloud?

（A）Bypass

（B）Quarantined

（C）Inactive

（D）Deregistered

正解：A 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 9

Which Live Query statement is properly constructed?

（A）SELECT * FROM users;

（B）SELECT * FROM 'users'

（C）select * from *:

（D）select from users;

正解：A 解答を投票する

質問 10

An administrator ran the following query.
SELECT name, VERSION, install_location, install_source, publisher, install_date, uninstall_string FROM programs WHERE publisher = "Microsoft Corporation"; The administrator notices a lot of installed programs are not returned.
How can the administrator alter the query to see all results?

（A）Edit the WHERE clause to remove the quotes

（B）Remove the WHERE clause

（C）Replace the = with LIKE

（D）Change the WHERE clause to = "*"

正解：A 解答を投票する

5V0-91.20 無料問題集「VMware Carbon Black Portfolio Skills」

弊社を連絡する

関連リンク

トップ試験