[Jul 07, 2022] 5V0-91.20 Dumps Full Questions – Exam Study Guide [Q40-Q55]

NO.40 Which reputation is processed with the lowest priority for Endpoint Standard?

Local White

Known Malware

Trusted White

Common White

NO.41 Management has directed that the SOC team be enabled to create global file bans via the App Control API.
How would this be configured in the App Control Console?

Create a Role, map to corresponding SOC group, and add permission “Manage files” to Role.

Add permission “Manage files” and create an API token for each SOC user.

Create a Role, map to the corresponding SOC group, add permission “Manage files”, and create API token for the Role.

Create a Role, map it to the corresponding SOC group, add permission “Manage files” to Role, and create an API token for each user in group.

NO.42 An Endpoint Standard administrator finds a binary in the environment and decides to manually add the file hash to the Banned List.
Which reputation does the file now have?

Suspect/Heuristic Malware

Company Black

Adware/PUP Malware

Known Malware

NO.43 Which Sensor Status under Endpoint Health indicates that a system’s policy enforcement is disabled, and the sensor is not sending security event data to the cloud?

Quarantined

Deregistered

Inactive

Bypass

NO.44 An administrator needs to check configurations using Audit across several policies and locations within the organization.
How can the administrator run the query to only these specific devices?

Specify endpoints on the query by selecting the check box for each device.

Specify endpoints on the query by typing the sensor name into the text box, selecting the device. Repeat as necessary for all devices.

Specify the policy for the endpoints on the query, and then select the check box for each device.

Specify the policy for the endpoints on the query, and then type the sensor name into the text box, selecting the devices. Repeat as necessary for all devices.

NO.45 Which identifier is shared by all events when an alert is investigated?

Process ID

Event ID

Priority Score

Alert ID

NO.46 An administrator is reviewing an alert about a known and required application in the environment. The application has been given the reputation of PUP, with the alert reason being that the PUP was detected. As a result, this application is matching policy blocking & isolation rules for PUPs in the environment and Is not behaving as expected.
Which step should the administrator take to remediate this situation?

Add the file to the Approved List and Dismiss alert

Add the file to the Approved List

Dismiss the alert

Add the file to the Banned List and Delete application

NO.47 An administrator needs to manage a group of sensors from within the console.
Which three actions are available for sensors within the Sensor Group? (Choose three.)

Move to group

Disable

Restart

Ban

Uninstall

Share Settings

NO.48 Refer to the exhibit:

Which statement is true in regards to communication between the sensor and server?

The sensor must be able to resolve the name cb.yourcompany.com.

The server must have an entry in the host file for cb.yourcompany.com.

The communication is unencrypted.

The sensor will communicate on a non-default port.

NO.49 Review the following EDR query:
(parent_name:powershell.exe OR parent_name:cmd.exe) AND netconn_count:[l TO *] Which process would show in the query results?

Processes invoked by Powershell.exe and cmd.exe with a single network connection event

Processes invoking Powershell.exe and cmd.exe with multiple network connection events

Processes invoked by Powershell.exe or cmd.exe with any number of network connection events

Processes invoking Powershell.exe or cmd.exe with multiple network connection events

NO.50 An administrator needs to query all endpoints in the HR group for instances of an obfuscated copy of cmd.exe.
Given this Enterprise EDR query:
process_name:cmd.exe AND device_group:HR AND NOT enriched:true
Which example could be added to the query to provide the desired results?

NOT process_name:cmd.exe

NOT process_original_filename:cmd.exe

NOT process_company_name:cmd.exe

NOT process_internal_name:cmd.exe

NO.51 Given the following query:
SELECT * FROM users WHERE UID >= 500;
Which statement is correct?

This query limits the number of columns to display in the results.

This query filters results sent to the cloud.

This query is missing a parameter for validity.

This query returns all accounts found on systems.

NO.52 An Enterprise EDR administrator has created a custom Watchlist and wants to add a custom query to a report in the custom Watchlist.
From which page can the administrator add this custom query?

Policies

Watchlists

Investigate

Cloud Analysis

NO.53 There is a need to ignore all activity at an application path.
Which rule definition should be used to address this need?

Application at Path, Performs any operation, Bypass

Application at Path, Runs or is Running, Bypass

Application at Path, Runs or is Running, Allow & Log

Application at Path, Performs any operation, Allow & Log

NO.54 Refer to the exhibit, noting the circled red dot:

What is the meaning of the red dot under Hits in the Process Search page?

Whether the execution of the process resulted in a syslog hit

Whether the execution of the process resulted in a sensor hit

Whether the execution of the process resulted in matching hits for different users

Whether the execution of the process resulted in a feed hit

NO.55 An analyst is investigating an alert within Enterprise EDR. The alert is tied to an unusual process name. When navigating to the binary details page, for the binary used in the alert, the analyst sees the following:

The analyst wants to find any instances of this process executing regardless of the process name used.
Which two details from the binary can be used to search for the application regardless of the seen name? (Choose two.)

The binary’s hash

The path

The original filename

The product version

The publisher name

[Jul 07, 2022] 5V0-91.20 Dumps Full Questions – Exam Study Guide [Q40-Q55]

Difficulty in Writing VMware 5V0-91.20: VMware Carbon Black Portfolio Skills Exam

For more info read reference:

Be the first to reply

Leave a Reply Cancel reply

Difficulty in Writing VMware 5V0-91.20: VMware Carbon Black Portfolio Skills Exam

For more info read reference: