2024 Correct and Up-to-date VMware 5V0-93.22 BrainDumps
Current 5V0-93.22 dumps Preparation through Our Practice Test
NEW QUESTION # 30
An administrator wants to prevent malicious code that has not been seen before from retrieving credentials from the Local Security Authority Subsystem Service, without causing otherwise good applications from being blocked.
Which rule should be used?
- A. [Not listed application] [Scrapes memory of another process] [Terminate process]
- B. [**/*.exe] [Scrapes memory of another process] [Terminate process]
- C. [**\lsass.exe] [Scrapes memory of another process] [Deny operation]
- D. [Unknown application] [Retrieves credentials] [Terminate process]
Answer: A
NEW QUESTION # 31
An organization is implementing policy rules. The administrator mentions that one operation attempt must use a Terminate Process action.
Which operation attempt has this requirement?
- A. Performs ransom ware-like behavior
- B. Runs or is running
- C. Scrapes memory of another process
D Invokes a command interpreter
Answer: C
Explanation:
Explanation
The operation attempt that must use a Terminate Process action is Scrapes memory of another process. This is a policy rule in VMware Carbon Black Cloud Endpoint Standard that blocks and terminates any process that attempts to read the memory of another process. This is a common technique used by malware to steal sensitive information, such as passwords, encryption keys, or tokens, from legitimate applications. By using a Terminate Process action, the policy rule ensures that the malicious process is stopped and removed from the endpoint, preventing further damage or data exfiltration. The other operation attempts do not require a Terminate Process action, but they can use other actions, such as Alert, Deny, or Isolate Device, depending on the policy configuration and the security needs of the organization. References: Carbon Black Cloud Endpoint Standard - Technical Overview, Best Practices: Endpoint Standard Blocking & Isolation Rules, Endpoint Standard: Deny/Terminate action taken on an Allowed Application
NEW QUESTION # 32
Where can a user identify whether a sensor's signature pack is out-of-date in VMware Carbon Black Cloud?
- A. Inventory > Endpoints > Sensor Update Status
- B. Inventory > Endpoints > Device Name
- C. Enforce > Investigate > Sensors > Details
- D. Enforce > Inventory > Endpoints > Policy
Answer: A
NEW QUESTION # 33
Which statement accurately characterizes Alerts that are categorized as a "Threat" versus those categorized as
"Observed"?
- A. "Threat" indicates that no block (Deny or Terminate) has occurred. "Observed" indicates a block.
- B. "Threat" indicates an ongoing attack. "Observed" indicates the attack is over and is being watched.
- C. "Threat" indicates a more likely malicious event. "Observed" are less likely to be malicious.
- D. "Threat" indicates a block (Deny or Terminate) has occurred. "Observed" indicates that there is no block.
Answer: C
NEW QUESTION # 34
Which statement is true regarding Blocking/Isolation rules and Permission rules?
- A. Permission Rules are overridden by Blocking & Isolation rules
- B. D.Blocking & Isolation rules are overridden by Permission Rules
- C. Upload Rules are overridden by Blocking & Isolation rules.
- D. Blocking & Isolation rules are overridden by Upload Rules.
Answer: B
Explanation:
Explanation
The correct statement regarding Blocking/Isolation rules and Permission rules is D. Blocking & Isolation rules are overridden by Permission Rules. This means that if a file or process matches both a Blocking/Isolation rule and a Permission rule, the action specified by the Permission rule will take precedence over the action specified by the Blocking/Isolation rule. For example, if a file has a reputation of SUSPECT_MALWARE and a Blocking/Isolation rule is set to terminate any SUSPECT_MALWARE file that runs, but a Permission rule is set to allow and log any file that runs from a specific path, the file will be allowed and logged if it runs from that path, regardless of its reputation. Permission rules are useful for tuning the behavior of VMware Carbon Black Cloud Endpoint Standard and preventing false positives or unnecessary blocks1.
The other statements are false or irrelevant. Blocking & Isolation rules are not overridden by Upload Rules.
Upload Rules are rules that specify which files and metadata are uploaded to the Carbon Black Cloud for analysis and reputation. Upload Rules do not affect the prevention or detection capabilities of VMware Carbon Black Cloud Endpoint Standard2. Permission Rules are not overridden by Blocking & Isolation rules. As explained above, Permission Rules have a higher priority than Blocking & Isolation rules and can override their actions. Upload Rules are not overridden by Blocking & Isolation rules. Upload Rules and Blocking & Isolation rules are independent of each other and do not affect each other's functionality. References:
Prevention Policy Settings - VMware Docs, Permissions section, Action subsection.
Upload Rules - VMware Docs, Overview section.
NEW QUESTION # 35
A script-based attack has been identified that inflicted damage to the corporate systems. The security administrator found out that the malware was coded into Excel VBA and would like to perform a search to further inspect the incident.
Where in the VMware Carbon Black Cloud Endpoint Standard console can this action be completed?
- A. Alerts
- B. Settings
- C. Endpoints
- D. Investigate
Answer: D
Explanation:
Explanation
The Investigate page in the VMware Carbon Black Cloud Endpoint Standard console is where the security administrator can perform a search to further inspect the script-based attack that was coded into Excel VBA.
The Investigate page allows the administrator to use advanced search techniques to query the endpoint data collected by the VMware Carbon Black Cloud sensors. The administrator can use various fields and operators to filter and refine the search results, such as process_name, file_name, file_path, file_type, file_description, and more. The administrator can also use the processtree view to visualize the process execution and the event details to examine the process activity. For example, the administrator can use the following search query to find all the processes that have a file type of Excel VBA:
file_type:EXCEL_VBA
This query will return all the processes that have a file type of EXCEL_VBA, which is a file type that indicates the file contains Excel VBA code. The file_type field is a string that indicates the type of the file based on its content and format. The possible values for this field are:
EXE: Executable file
DLL: Dynamic-link library file
SYS: System file
BAT: Batch file
CMD: Command file
VBS: Visual Basic Script file
JS: JavaScript file
PS1: PowerShell Script file
HTA: HTML Application file
MSI: Windows Installer file
DOC: Microsoft Word document file
XLS: Microsoft Excel spreadsheet file
PPT: Microsoft PowerPoint presentation file
PDF: Portable Document Format file
SWF: Shockwave Flash file
JAR: Java Archive file
CLASS: Java class file
PY: Python script file
SH: Shell script file
PL: Perl script file
RB: Ruby script file
PHP: PHP script file
ASP: Active Server Pages file
ASPX: Active Server Pages Extended file
HTML: HyperText Markup Language file
XML: Extensible Markup Language file
DOCM: Microsoft Word document with macros file
XLAM: Microsoft Excel add-in with macros file
XLSM: Microsoft Excel spreadsheet with macros file
XLTM: Microsoft Excel template with macros file
PPTM: Microsoft PowerPoint presentation with macros file
POTM: Microsoft PowerPoint template with macros file
PPAM: Microsoft PowerPoint add-in with macros file
EXCEL_VBA: Excel Visual Basic for Applications file
WORD_VBA: Word Visual Basic for Applications file
POWERPOINT_VBA: PowerPoint Visual Basic for Applications file
OUTLOOK_VBA: Outlook Visual Basic for Applications file
ACCESS_VBA: Access Visual Basic for Applications file
PROJECT_VBA: Project Visual Basic for Applications file
VISIO_VBA: Visio Visual Basic for Applications file
PUBLISHER_VBA: Publisher Visual Basic for Applications file
INFOPATH_VBA: InfoPath Visual Basic for Applications file
ONENOTE_VBA: OneNote Visual Basic for Applications file
UNKNOWN: Unknown file type
Therefore, by using the Investigate page in the VMware Carbon Black Cloud Endpoint Standard console, the security administrator can perform a search to further inspect the script-based attack that was coded into Excel VBA. References:
Investigate Endpoint Data - VMware Docs, Overview section.
Advanced Search Techniques - VMware Docs, Using Fields section, file_type subsection.
NEW QUESTION # 36
A security administrator is tasked to enable Live Response on all endpoints in a specific policy.
What is the correct path to configure the required sensor policy setting?
- A. Policies > Policy > Sensor > Enforce
- B. Enforce > Policy > Policies > Sensor
- C. Policies > Enforce > Policy > Sensor
- D. Enforce > Policies > Policy > Sensor
Answer: B
NEW QUESTION # 37
A company wants to prevent an executable from running in their organization. The current reputation for the file is NOT LISTED, and the machines are in the default standard policy.
Which action should be taken to prevent the file from executing?
- A. Add the hash to the MALWARE list.
- B. Use Live Response to delete the file.
- C. Use Live Response to kill the process.
- D. Add the hash to the company banned list.
Answer: D
NEW QUESTION # 38
A security administrator notices an unusual software behavior on an endpoint. The administrator immediately used the search query to collect data and start analyzing indicators to find the solution.
What is a pre-requisite step in gathering specific vulnerability data to export it as a CSV file for analysis?
- A. Perform a custom search on the Endpoint Page.
- B. Search for specific malware byhash or filename.
- C. Access the Audit Log content to see associated events.
- D. Enable cloud analysis.
Answer: A
NEW QUESTION # 39
An administrator wants to block an application by its path instead of reputation. The following steps have already been taken:
Go to Enforce > Policies > Select the desired policy >
Which additional steps must be taken to complete the task?
- A. Scroll down to the Blocking and Isolation section > Click Edit (pencil icon) for the desired Reputation
- B. Scroll down to the Permissions section > Click Add application path > Enter the path of the desired application
- C. Click Enforce > Add application path name
- D. Scroll down to the Blocking and Isolation section > Click Add application path > Enter the path of the desired application
Answer: D
Explanation:
To block an application by its path instead of reputation, the administrator needs to follow these steps:
Go to Enforce > Policies > Select the desired policy.
Scroll down to the Blocking and Isolation section.
Click Add application path.
Enter the path of the desired application, such as C:\Program Files\Example\example.exe.
Choose the action to take when the application is detected, such as Block or Allow.
Optionally, add a description for the application path rule.
Click Save to apply the changes to the policy.
The other options are incorrect because they do not specify the correct section, button, or field for blocking an application by its path. The Enforce section is for managing the policy assignments, not the policy rules. The Permissions section is for managing the application control rules, not the application blocking rules. The Edit (pencil icon) button is for modifying the existing reputation levels, not for adding a new application path rule. References:
VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Module 3: Application Control, pages 3-7 to 3-8.
VMware Carbon Black Cloud Endpoint Standard User Guide, Chapter 9: Application Control, pages
115-116.
NEW QUESTION # 40
An administrator has been tasked with preventing the use of unauthorized USB storage devices from being used in the environment.
Which item needs to be enabled in order to enforce this requirement?
- A. Enable the Block access to all unapproved USB devices within the policies option.
- B. Elect to approve only allowed USB devices from the USB Devices page.
- C. Choose to disable USB device access on each endpoint from the Inventory page.
- D. Select the option to block USB devices from the Reputation page.
Answer: B
Explanation:
Explanation
To prevent the use of unauthorized USB storage devices, the administrator needs to enable the USB Device Control feature in the VMware Carbon Black Cloud Endpoint Standard. This feature allows the administrator to approve or block specific USB devices based on their vendor ID, product ID, serial number, and device type. The administrator can also set a default action for unapproved USB devices, such as block, read-only, or allow. The administrator can manage the USB devices from the USB Devices page under the Settings menu. From this page, the administrator can view the list of USB devices that have been detected by the endpoints, and elect to approve only the allowed USB devices. The administrator can also export or import the list of approved USB devices for backup or replication purposes. References:
VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Module 4: USB Device Control, pages 4-1 to 4-9.
VMware Carbon Black Cloud Endpoint Standard User Guide, Chapter 11: USB Device Control, pages
147-152.
NEW QUESTION # 41
A security administrator is tasked to investigate an alert about a suspicious running process trying to modify a system registry.
Which components can be checked to further inspect the cause of the alert?
- A. Priority score, file reputation, and timestamp
- B. Command lines. Device ID, and priority score
- C. Event details, command lines, and TTPs involved
- D. TTPs involved, network connections, and child path
Answer: C
NEW QUESTION # 42
An organization has the following requirements for allowing application.exe:
Must not work for any user's D:\ drive
Must allow running only from inside of the user's Temp\Allowed directory Must not allow running from anywhere outside of Temp\Allowed For example, on one user's machine, the path is C:\Users\Lorie\Temp\Allowed\application.exe.
Which path meets this criteria using wildcards?
- A. *:\Users\*\Temp\Allowed\application.exe
- B. C:\Users\?\Temp\Allowed\application.exe
- C. C:\Users\*\Temp\Allowed\application.exe
- D. *:\Users\**\Temp\Allowed\application.exe
Answer: D
Explanation:
Explanation
The path that meets the criteria for allowing application.exe using wildcards is :\Users*
\Temp\Allowed\application.exe. This path specifies that the executable file can run only from inside of the user's Temp\Allowed directory, regardless of the drive letter or the user name. The wildcards used in this path are:
*: Matches any single character or no character at all. For example, *:\ matches any drive letter, such as C:, D:, or E:.
**: Matches a partial path across all subdirectory levels and is recursive. For example, \Users**\ matches any subdirectory under the Users directory, such as \Users\Lorie, \Users\John, or
\Users\Alice\Documents.
The other paths do not meet the criteria for allowing application.exe using wildcards. A.
C:\Users?\Temp\Allowed\application.exe does not allow running from any drive other than C:, and it only matches a single character for the user name, which may not be sufficient. B.
C:\Users*\Temp\Allowed\application.exe does not allow running from any drive other than C:, and it may match more than one character for the user name, which may not be desired. D.
*:\Users*\Temp\Allowed\application.exe allows running from any drive, but it may match more than one character for the user name, which may not be desired. References:
Carbon Black Cloud: How to Use Wildcards in Policy Rules - Carbon Black Community, Wildcard Description table.
NEW QUESTION # 43
An administrator would like to proactively know that something may get blocked when putting a policy rule in the environment.
How can this information be obtained?
- A. Search the data using the test rule functionality.
B Examine log files to see what would be impacted - B. Put the rules in and see what happens to the endpoints.
D Determine what would happen based on previously used antivirus software
Answer: A
Explanation:
Explanation
The best way to proactively know that something may get blocked when putting a policy rule in the environment is to search the data using the test rule functionality in the VMware Carbon Black Cloud Endpoint Standard console. The test rule functionality allows the administrator to test a new rule's settings before applying it in the environment. The system checks to see how the rule would have affected the organization over the last 30 days and displays the number of devices and events that would have been impacted by the rule. The administrator can use this data to confirm or modify the settings and avoid unnecessary blocks or false positives. The test rule functionality is available for both permission rules and blocking and isolation rules12.
The other options are not recommended or feasible for obtaining this information. Examining log files to see what would be impacted is not a reliable or efficient method, as it would require manually reviewing a large amount of data and correlating it with the rule settings. Putting the rules in and seeing what happens to the endpoints is a risky and reactive approach, as it could cause disruption or damage to the endpoints and the network. Determining what would happen based on previously used antivirus software is not a valid or accurate method, as different antivirus software may have different detection and prevention capabilities and configurations. References:
Set Permission Policy Rules - VMware Docs, Procedure section, step 7.
Set Blocking and Isolation Policy Rules - VMware Docs, Procedure section, step 7.
NEW QUESTION # 44
The use of leading wildcards in a query is not recommended unless absolutely necessary because they carry a significant performance penalty for the search.
What is an example of a leading wildcard?
- A. filemod:system32/ntdll.dll*
- B. filemod:system32/*ntdll.dll
- C. filemod:system32/ntdll.dll
- D. filemod:*/system32/ntdll.dll
Answer: D
Explanation:
Explanation
A leading wildcard is a wildcard that is placed at the beginning of a search term, such as * or ?. A leading wildcard matches any characters that precede the specified term. For example, filemod:/system32/ntdll.dll matches any file modification events that end with /system32/ntdll.dll, regardless of the drive letter or the directory name. A leading wildcard is not recommended unless absolutely necessary because it carries a significant performance penalty for the search. This is because the search engine has to scan the entire index for possible matches, rather than using the index to quickly narrow down the results1.
The other options are not examples of leading wildcards. A. filemod:system32/ntdll.dll is an exact match query that matches only file modification events that are exactly system32/ntdll.dll. B. filemod:system32/ ntdll.dll is a trailing wildcard query that matches any file modification events that start with system32/ and end with ntdll.dll, regardless of the characters in between. D. filemod:system32/ntdll.dll is a trailing wildcard query that matches any file modification events that start with system32/ntdll.dll, regardless of the characters that follow. References:
Search Syntax - VMware Docs, Wildcards section.
NEW QUESTION # 45
Which VMware Carbon Black Cloud integration is supported for SIEM?
- A. SolarWinds
- B. LogRhythm
- C. Splunk App
- D. Datadog
Answer: C
Explanation:
The VMware Carbon Black Cloud integration that is supported for SIEM is the Splunk App. The Splunk App allows administrators to bring alerts, events, audit logs, or vulnerability data from Carbon Black Cloud into their Splunk dashboard1. The Splunk App also supports Splunk SOAR, which enables automated actions and workflows based on Carbon Black Cloud alerts2.
The other options are not supported for SIEM integration with Carbon Black Cloud. SolarWinds, LogRhythm, and Datadog are not listed among the 140+ ecosystempartnerships and integrations that Carbon Black Cloud offers3. They are also not part of the Next-Gen SOC Alliance, which features Splunk, IBM Security, Google Cloud's Chronicle, Exabeam, and Sumo Logic integrations with Carbon Black Cloud1. References:
VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.6: Integrations VMware Carbon Black Cloud Endpoint Standard User Guide, Chapter 12: Integrations Integrations and APIs - VMware Carbon Black Cloud - Cloud SIEM | Sumo Logic Docs VMware Launches Next-Gen SOC Alliance with Splunk, IBM ... - VMware Blogs
NEW QUESTION # 46
A security administrator is tasked to enable Live Response on all endpoints in a specific policy.
What is the correct path to configure the required sensor policy setting?
- A. Policies > Policy > Sensor > Enforce
- B. Policies > Enforce > Policy > Sensor
- C. Enforce > Policies > Policy > Sensor
- D. Enforce > Policy > Policies > Sensor
Answer: C
Explanation:
Explanation
To enable Live Response on all endpoints in a specific policy, the security administrator needs to follow the correct path to configure the required sensor policy setting. The correct path is Enforce > Policies > Policy > Sensor. This path allows the administrator to select a policy group, then click on the Sensor tab, where they can select or deselect the Enable Live Response checkbox as applicable, and then click Save. This will enable or disable Live Response for all endpoints that are assigned to that policy group. The other options are incorrect because they do not match the correctpath to configure the sensor policy setting for Live Response. References: Use Live Response, Use Live Response for VM Workloads
NEW QUESTION # 47
An administrator needs to add an application to the Approved List in the VMware Carbon Black Cloud console.
Which two different methods may be used for this purpose? (Choose two.)
- A. IT Tool
- B. Application Name
- C. MD5 Hash
- D. Application Path
- E. Signing Certificate
Answer: D,E
Explanation:
Explanation
The VMware Carbon Black Cloud Endpoint Standard allows administrators to add applications to the Approved List, which approves the presence and actions of specified applications on the endpoints. Adding to the Approved List is global in its effects and applies to all policies attached to a particular version of an application. There are two different methods that can be used to add applications to the Approved List: by signing certificate or by application path.
By signing certificate: This method allows administrators to approve files that are signed by a specific certificate authority (CA) or signer. For example, if an administrator wants to approve all files that are signed by Google Inc, they can add the signer name and the CA name to the Approved List. This method is useful for approving files that are frequently updated or have dynamic names or paths.
However, administrators should be careful when using wildcards or approving certificates from untrusted sources, as this could lead to incidentally approving malicious software that appears to be signed by a trusted CA or signer.
By application path: This method allows administrators to approve files that are located in a specific path on the endpoint. For example, if an administrator wants to approve a custom application that is installed in C:\Program Files\Custom Application\, they can add the path and the file name to the Approved List. This method is useful for approving files that have a fixed name and location on the endpoint. However, administrators should be aware that this method does not account for new versions of the application, and they should routinely update the Approved List to reflect the changes.
Administrators can also use wildcards to target certain files or directories, but they should be as specific as possible to avoid approving unwanted files.
The other options are not valid methods for adding applications to the Approved List. MD5 hash is a method for adding files to the Banned List, which prevents specific files from running on the endpoints by their hash values. Application name is a method for creating permission rules, which allow or deny the presence and actions of an application only on a specific device. IT Tool is not a method, but a category of applications that are recommended to be added to the Approved List, such as software deployment tools, executable installers, IDEs, compilers, or script editors. References: Adding to the Approved List, Endpoint Standard: How to add a Certificate to the Approved List, Endpoint Standard: How to add a SHA256 hash to Approved/Banned List
NEW QUESTION # 48
Where can a user identify whether a sensor's signature pack is out-of-date in VMware Carbon Black Cloud?
- A. Inventory > Endpoints > Sensor Update Status
- B. Inventory > Endpoints > Device Name
- C. Enforce > Investigate > Sensors > Details
- D. Enforce > Inventory > Endpoints > Policy
Answer: B
Explanation:
Explanation
To identify whether a sensor's signature pack is out-of-date in VMware Carbon Black Cloud, the user can go to the Inventory page, select the Endpoints tab, and click on the device name of the endpointthey want to check. This will open the Endpoint Details page, where the user can see the Sensor Update Status, which shows the current version and date of the sensor's signature pack, as well as the latest available version and date. If the current version is lower than the latest version, the sensor's signature pack is out-of-date and needs to be updated. References: VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 3.2.1: Monitor Sensor Health and Update Status, Page 25.
NEW QUESTION # 49
An administrator is working in a development environment that has a policy rule applied and notices that there are too many blocks. The administrator takes action on the policy rule to troubleshoot the issue until the blocks are fixed.
Which action should the administrator take?
- A. Disable
- B. Delete
- C. Recall
- D. Unenforce
Answer: D
Explanation:
Explanation
Unenforcing a policy rule means that the rule will still be evaluated, but the actions will not be taken. This allows the administrator to troubleshoot the issue without affecting the endpoints or generating alerts. Disabling, recalling, or deleting a policy rule will remove it from the evaluation process and may affect the security posture of the organization. References: VMware Carbon Black Cloud Endpoint Standard Skills Exam Guide1, VMware Carbon Black Cloud Endpoint Standard - On Demand Course
NEW QUESTION # 50
An administrator needs to use an ID to search and investigate security incidents in Carbon Black Cloud.
Which three IDs may be used for this purpose? (Choose three.)
- A. Sensor
- B. Threat
- C. Event
- D. Alert
- E. Hash
- F. User
Answer: A,D,E
Explanation:
The IDs that may be used to search and investigate security incidents in Carbon Black Cloud are hash, sensor, and alert.
A hash is a unique identifier for a file or process that can be used to track its activity and behavior across endpoints. A hash can be searched in the Investigate page to view its reputation, prevalence, and associated alerts.
A sensor is a unique identifier for an endpoint that has the Carbon Black Cloud agent installed. A sensor can be searched in the Endpoints page to view its status, policy, and associated alerts. A sensor can also be searched in the Investigate page to view its processes, events, and network connections.
An alert is a unique identifier for a security incident that is generated by Carbon Black Cloud based on the policy rules and threat intelligence. An alert can be searched in the Alerts page to view its details, timeline, and remediation actions. An alert can also be searched in the Investigate page to view its associated processes, events, and network connections.
A threat is not a valid ID for searching and investigating security incidents in Carbon Black Cloud. A threat is a term used to describe a malicious actor or activity that poses a risk to the organization. A threat can be detected by Carbon Black Cloud based on the threat intelligence feeds and watchlists, but it is not a unique identifier for a specific incident.
An event is not a valid ID for searching and investigating security incidents in Carbon Black Cloud. An event is a term used to describe a single action or occurrence that is recorded by the Carbon Black Cloud agent on an endpoint. An event can be viewed in the Investigate page as part of a process or alert, but it is not a unique identifier for a specific incident.
A user is not a valid ID for searching and investigating security incidents in Carbon Black Cloud. A user is a term used to describe a person who has access to the Carbon Black Cloud console or API. A user can be searched in the Users page to view their role, permissions, and activity, but they are not directly related to security incidents. References:
VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.1: Investigate VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.2: Alerts VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.3: Endpoints VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.4: Threats VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.5: Users
NEW QUESTION # 51
Which statement accurately characterizes Alerts that are categorized as a "Threat" versus those categorized as
"Observed"?
- A. "Threat" indicates that no block (Deny or Terminate) has occurred. "Observed" indicates a block.
- B. "Threat" indicates an ongoing attack. "Observed" indicates the attack is over and is being watched.
- C. "Threat" indicates a more likely malicious event. "Observed" are less likely to be malicious.
- D. "Threat" indicates a block (Deny or Terminate) has occurred. "Observed" indicates that there is no block.
Answer: C
Explanation:
Explanation
According to the VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, alerts are categorized as either "Threat" or "Observed" based on the severity and confidence of the event. "Threat" alerts indicate a high-severity and high-confidence event that is more likely to be malicious, such as a ransomware attack, a credential theft, or a network beacon. "Observed" alerts indicate a low-severity and low-confidence event that is less likely to be malicious, such as a suspicious registry modification, a fileless script execution, or a process injection. The categorization of alerts helps analysts prioritize their investigations and responses. References: VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, page 14, section 2.3.1. Alert Categories. [Link]
NEW QUESTION # 52
An administrator has determined that the following rule was the cause for an unexpected block:
[Suspected malware] [Invokes a command interpreter] [Terminate process] All reputations for the process which was blocked show SUSPECT_MALWARE.
Which reputation was used by the sensor for the decision to terminate the process?
- A. Actioned reputation
- B. Effective reputation
- C. Current Cloud reputation
- D. Initial Cloud reputation
Answer: B
Explanation:
Explanation
The reputation that was used by the sensor for the decision to terminate the process was the effective reputation. The effective reputation is the reputation that the sensor uses to evaluate and enforce policy rules on the endpoint. The effective reputation is determined by the following factors:
The initial cloud reputation, which is the reputation that the Carbon Black Cloud assigns to the file based on its analysis and threat intelligence feeds.
The actioned reputation, which is the reputation that the administrator assigns to the file through the Carbon Black Cloud console, such as approve, ban, or dismiss.
The current cloud reputation, which is the reputation that the Carbon Black Cloud updates for the file based on new information or changes in the threat landscape.
The effective reputation is the highest priority reputation among these three factors. For example, if the initial cloud reputation is SUSPECT_MALWARE, the actioned reputation is APPROVED, and the current cloud reputation is KNOWN_MALWARE, the effective reputation will be APPROVED, because it has the highest priority. The sensor will use the effective reputation to apply the policy rules on the endpoint. In this case, the process will not be blocked by the rule [Suspected malware] [Invokes a command interpreter] [Terminate process], because the effective reputation is not SUSPECT_MALWARE.
In the question scenario, the effective reputation for the process was SUSPECT_MALWARE, which means that either the initial cloud reputation, the actioned reputation, or the current cloud reputation was SUSPECT_MALWARE, and there was no higher priority reputation that overrode it. Therefore, the sensor used the effective reputation to enforce the policy rule and terminate the process. References:
Endpoint Standard: How to Confirm Applied ... - VMware Carbon Black, Resolution section.
NEW QUESTION # 53
An administrator has configured a permission rule with the following options selected:
Application at path: C:\Program Files\**
Operation Attempt: Performs any operation
Action: Bypass
What is the impact, if any, of using the wildcards in the path?
- A. Only executable files in the "Program Files" folder will be ignored, includingmalware files.
- B. No Files will be ignored from the "Program Files" director/, but Malware in the "Program Files" directory will continue to be blocked.
- C. Executable files in the "Program Files" folder will be blocked.
- D. All executable files in the "Program Files" folder and subfolders will be ignored, includingmalware files.
Answer: D
Explanation:
Explanation
The impact of using the wildcards in the path is that all executable files in the "Program Files" folder and subfolders will be ignored, including malware files. This is because the double asterisk ** matches any files or directories in that path, and the Bypass action means that the sensor will notmonitor or block any operations performed by those files. This is a very permissive and risky rule, as it could allow malicious files to run without interference from the sensor. A more restrictive and secure rule would be to specify the exact path of the application that needs to be allowed, and use the Allow and Log action instead of Bypass. This way, the sensor will only ignore the specified application, and still log its operations for visibility and analysis. References: Carbon Black Cloud: How to Use Wildcards in Policy Rules, Set Permission Policy Rules
NEW QUESTION # 54
......
100% Reliable Microsoft 5V0-93.22 Exam Dumps Test Pdf Exam Material: https://www.testkingit.com/VMware/latest-5V0-93.22-exam-dumps.html
Based on Official Syllabus Topics of Actual VMware 5V0-93.22 Exam: https://drive.google.com/open?id=1-Hiljb4XuZ1VElIit4fEt0XAXKMlS8C5