Unique Top-selling 5V0-93.22 Exams – New 2024 VMware Pratice Exam [Q15-Q39]

Rate this post

Unique Top-selling 5V0-93.22 Exams – New 2024 VMware Pratice Exam

VMware Security Solutions Dumps 5V0-93.22 Exam for Full Questions – Exam Study Guide

NO.15 Which port does the VMware Carbon Black sensor use to communicate to VMware Carbon Black Cloud?

443

8443

NO.16 An administrator has configured a terminate rule to prevent an application from running. The administrator wants to confirm that the new rule would have prevented a previous execution that had been observed.
Which feature should the administrator leverage for this purpose?

Setup a notification based on a policy action, and then select Terminate.

Utilize the Test rule link from within the rule.

Configure the rule to terminate the process.

Configure the rule to deny operation of the process.

NO.17 An administrator needs to use an ID to search and investigate security incidents in Carbon Black Cloud.
Which three IDs may be used for this purpose? (Choose three.)

Threat

Hash

Sensor

Event

User

Alert

The IDs that may be used to search and investigate security incidents in Carbon Black Cloud are hash, sensor, and alert.
A hash is a unique identifier for a file or process that can be used to track its activity and behavior across endpoints. A hash can be searched in the Investigate page to view its reputation, prevalence, and associated alerts.
A sensor is a unique identifier for an endpoint that has the Carbon Black Cloud agent installed. A sensor can be searched in the Endpoints page to view its status, policy, and associated alerts. A sensor can also be searched in the Investigate page to view its processes, events, and network connections.
An alert is a unique identifier for a security incident that is generated by Carbon Black Cloud based on the policy rules and threat intelligence. An alert can be searched in the Alerts page to view its details, timeline, and remediation actions. An alert can also be searched in the Investigate page to view its associated processes, events, and network connections.
A threat is not a valid ID for searching and investigating security incidents in Carbon Black Cloud. A threat is a term used to describe a malicious actor or activity that poses a risk to the organization. A threat can be detected by Carbon Black Cloud based on the threat intelligence feeds and watchlists, but it is not a unique identifier for a specific incident.
An event is not a valid ID for searching and investigating security incidents in Carbon Black Cloud. An event is a term used to describe a single action or occurrence that is recorded by the Carbon Black Cloud agent on an endpoint. An event can be viewed in the Investigate page as part of a process or alert, but it is not a unique identifier for a specific incident.
A user is not a valid ID for searching and investigating security incidents in Carbon Black Cloud. A user is a term used to describe a person who has access to the Carbon Black Cloud console or API. A user can be searched in the Users page to view their role, permissions, and activity, but they are not directly related to security incidents. References:
VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.1: Investigate VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.2: Alerts VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.3: Endpoints VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.4: Threats VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.5: Users

NO.18 Which VMware Carbon Black Cloud process is responsible for uploading event reporting to VMware Carbon Black Cloud?

Sensor Service (RepUx

Scanner Service (scanhost)

Scanner Service (Re

Sensor Service (RepMqr

NO.19 An administrator is investigating an alert and reads a summary that says:
The application powershell.exe was leveraged to make a potentially malicious network connection.
Which action should the administrator take immediately to block that connection?

Click Delete Application

Click Quarantine Asset

Click Export Alert

Click Drop Connection

NO.20 The administrator has configured a permission rule with the following options selected:
Application at path: C:Users*Downloads**
Operation Attempt: Performs any operation
Action: Bypass
What is the impact, if any, of using the wildcards in the path for this rule?

Any executable in the downloads directory for any user on the system will be logged and allowed to execute.

No files will be ignored from the downloads directory.

Any executable in the downloads directory for any user on the system will be bypassed for inspection.

Any executable in the downloads directory will be prevented from executing.

NO.21 An administrator wants to prevent ransomware that has not been seen before, without blocking other processes.
Which rule should be used?

[Adware or PUP] [Scrapes memory of another process] [Deny operation]

[Not listed application] [Performs ransomware-like behavior] [Terminate process

[Unknown malware] [Runs or is running] [Terminate process]

[Not listed application] [Runs or is running] [Terminate process]

NO.22 An administrator has dismissed a group of alerts and ticked the box for “Dismiss future instances of this alert on all devices in all policies”. There is also a Notification configured to email the administrator whenever an alert of the same Severity occurs. The following day, a new alert is added to the same group of alerts.
How will this alert be handled?

The alert will show when the Dismissed filter is selected on the Alerts page, and a Notification email will be sent.

The alert will show when the Dismissed filter is selected on Alerts page, but a Notification email will not be sent.

The alert will show when the Not Dismissed filter is selected on Alerts page, and a Notification email will be sent.

The alert will show when Not Dismissed filter is selected on Alerts page, but a Notification email will not be sent.

NO.23 An administrator needs to find all events on the Investigate page where the process is svchost.exe, and the path is not the standard path of C:WindowsSystem32.
Which advanced search will yield these results?

process_name:svchost.exe EXCLUDE process_name:C:\Windows\System32

process_name:svchost.exe AND NOT process_name:C:WindowsSystem32

process_name:svchost.exe AND NOT process_name:C:\Windows\System32

process_name:svchost.exe EXCLUDE process_name:C:WindowsSystem32

NO.24 What connectivity is required for VMware Carbon Black Cloud Endpoint Standard to perform Sensor Certificate Validation?

TCP/443 to GoDaddy OCSP and CRL URLs (crl.godaddy.com and ocsp.godaddy.com)

TCP/80 to GoDaddy OCSP and CRL URLs (crl.godaddy.com and ocsp.godaddy.com)

TCP/443 to GoDaddy CRL URL (crl.godaddy.com and ocsp.godaddy.com)

TCP/80 to GoDaddy CRL URL (crl.godaddy.com and ocsp.godaddy.com)

NO.25 An administrator needs to create a search, but it must exclude “system.exe”.
How should this task be completed?

#process_name:system.exe

*process_name:system.exe

<process_name:system.exe>

-process_name:system.exe

NO.26 An organization is seeing a new malicious process that has not been seen before.
Which tool can be used to block this process?

Policy rules

Malware Removal

Certificate banned list

Live Response

NO.27 An administrator is reviewing how event data is categorized and identified in VMware Carbon Black Cloud.
Which method is used?

By Unique Process ID

By Process Name

By Unique Event ID

By Event Name

NO.28 What is a security benefit of VMware Carbon Black Cloud Endpoint Standard?

A flexible query scheduler that can be used to gather information about the environment

Visibility into the entire attack chain and customizable threat intelligence that can be used to gain insight into problems

Customizable threat feeds that plug into a single agent and single console

Policy rules that can be tested by selecting test rule next to the desired operation attempt

NO.29 An administrator needs to configure a policy for macOS and Linux Sensors, not enabling settings which are only applicable to Windows.
Which three settings are only applicable to Sensors on the Windows operating system? (Choose three.)

Delay execute for cloud scan

Allow user to disable protection

Submit unknown binaries for analysis

Expedited background scan

Scan execute on network drives
F Require code to uninstall sensor

NO.30 Which statement is true regarding Blocking/Isolation rules and Permission rules?

Blocking & Isolation rules are overridden by Upload Rules.

Permission Rules are overridden by Blocking & Isolation rules

Upload Rules are overridden by Blocking & Isolation rules.

D.Blocking & Isolation rules are overridden by Permission Rules

NO.31 An organization has the following requirements for allowing application.exe:
Must not work for any user’s D: drive
Must allow running only from inside of the user’s TempAllowed directory Must not allow running from anywhere outside of TempAllowed For example, on one user’s machine, the path is C:UsersLorieTempAllowedapplication.exe.
Which path meets this criteria using wildcards?

C:Users?TempAllowedapplication.exe

C:Users*TempAllowedapplication.exe

*:Users**TempAllowedapplication.exe

*:Users*TempAllowedapplication.exe

NO.32 An organization is implementing policy rules. The administrator mentions that one operation attempt must use a Terminate Process action.
Which operation attempt has this requirement?

Performs ransom ware-like behavior

Runs or is running

Scrapes memory of another process
D Invokes a command interpreter

NO.33 An administrator would like to proactively know that something may get blocked when putting a policy rule in the environment.
How can this information be obtained?

Search the data using the test rule functionality.
B Examine log files to see what would be impacted

Put the rules in and see what happens to the endpoints.
D Determine what would happen based on previously used antivirus software

NO.34 A security administrator is tasked to investigate an alert about a suspicious running process trying to modify a system registry.
Which components can be checked to further inspect the cause of the alert?

Command lines. Device ID, and priority score

Event details, command lines, and TTPs involved

TTPs involved, network connections, and child path

Priority score, file reputation, and timestamp

Explanation
These components can provide more information about the suspicious running process and its behavior, such as:
Event details: This component shows the details of the event that triggered the alert, such as the device name, the device time, the process name, the process path, the process ID, the operation type, the operation result, the registry key, the registry value, and the registry data. The event details can help the security administrator to identify the source and the target of the registry modification attempt, and to verify if the operation was successful or not.
Command lines: This component shows the command lines that were executed by the process or its parent process, such as the arguments, the parameters, the switches, and the environment variables. The command lines can help the security administrator to understand the purpose and the context of the process execution, and to detect any malicious or anomalous commands or scripts.
TTPs involved: This component shows the tactics, techniques, and procedures (TTPs) that were involved in the event, based on the MITRE ATT&CK framework. The TTPs can help the security administrator to assess the severity and the impact of the event, and to correlate the event with other related events or indicators of compromise.
The other components are not as useful or relevant for investigating the alert. A. Device ID and priority score are components that provide general information about the device and the alert, but they do not provide specific details about the suspicious running process or its behavior. C. Network connections and child path are components that show the network activity and the child processes of the suspicious running process, but they do not show the registry modification attempt or its result. D. File reputation and timestamp are components that show the reputation and the time of the file associated with the suspicious running process, but they do not show the command lines orthe TTPs involved in the event. References: VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.3.2: Investigate Alerts, Page 16.

NO.35 The administrator has configured a permission rule with the following options selected:
Application at path: C:Program Files**
Operation Attempt: Performs any operation
Action: Bypass
What is the impact, if any, of using the wildcards in the application at path field?

Executable files in the “Program Files” directory and subdirectories will be ignored.

Executable files in the “Program Files” directory will be blocked.

Executable files in the “Program Files” directory will be logged.

Executable files in the “Program Files” directory will be subject to blocking rules.

NO.36 In which tab of the VMware Carbon Black Cloud interface can sensor status details be found?

Enforce > Policies

Inventory > Sensors

Inventory > Endpoints

Inventory > Sensor groups

NO.37 The use of leading wildcards in a query is not recommended unless absolutely necessary because they carry a significant performance penalty for the search.
What is an example of a leading wildcard?

filemod:system32/ntdll.dll

filemod:system32/*ntdll.dll

filemod:*/system32/ntdll.dll

filemod:system32/ntdll.dll*

NO.38 Which command is used to immediately terminate a current Live Response session?

kill

detach -q

delete

execfg

NO.39 An administrator is working in a development environment that has a policy rule applied and notices that there are too many blocks. The administrator takes action on the policy rule to troubleshoot the issue until the blocks are fixed.
Which action should the administrator take?

Unenforce

Disable

Recall

Delete

VMware 5V0-93.22 certification exam covers a wide range of topics including Endpoint Protection, Threat Hunting, Incident Response, Endpoint Detection and Response, and Compliance Management. VMware Carbon Black Cloud Endpoint Standard Skills certification exam is designed to test the candidate’s understanding of these topics and their ability to apply them in real-world scenarios.

Best way to practice test for VMware 5V0-93.22: https://www.actualtorrent.com/5V0-93.22-questions-answers.html

Unique Top-selling 5V0-93.22 Exams – New 2024 VMware Pratice Exam [Q15-Q39]

Be the first to reply

Leave a Reply Cancel reply