VMware Carbon Black Portfolio Skills - 5V0-91.20 Exam Questions [2026]

QUESTION NO: 1
An administrator has updated a Threat Intelligence Report by turning it into a watchlist and needs to disable (Ignore) the old Threat Intelligence Report.
Where in the UI is this action not possible to perform?

A. Threat Report Page B. Search Threat Reports Page C. Threat Intelligence Feeds Page D. Triage Alerts Page

Correct Answer: C

QUESTION NO: 2
A company uses Audit and Remediation to check configurations and adhere to compliance regulations. The regulations require monthly reporting and twelve months of data retained.
How can an administrator accomplish this requirement with Audit and Remediation?

A. Schedule the query to run monthly, and no further action is required. B. Schedule the query to run monthly, and export the results for each run to an external location. C. Schedule the query to run monthly, and set the data retention to 12 months for the query. D. Schedule the query to run monthly, and configure the audit log retention to 12 months.

Correct Answer: B

QUESTION NO: 3
An analyst navigates to the alerts page in Endpoint Standard and sees the following:

What does the yellow color represent on the left side of the row?

A. It is an alert from a watchlist rather than the analytics engine. B. It is a threat alert and warrants immediate investigation. C. It is a dismissed alert within the user interface. D. It is an observed alert and may indicate suspicious behavior.

Correct Answer: A

QUESTION NO: 4
Which actions are available for Permissions?

A. Approve, Upload, No Upload B. Allow, Allow & Log, Bypass C. Performs any Operation, Runs or is running D. Deny Operation, Terminate Process

Correct Answer: B

QUESTION NO: 5
There is a requirement to block ransomware when a sensor is offline.
Which blocking and isolation rule fulfills this requirement?

A. Not Listed Application -> Performs ransomware-like behavior -> Deny operation B. Suspect Malware -> Performs ransomware-like behavior -> Deny operation C. Known Malware -> Performs ransomware-like behavior -> Terminate process D. Unknown Application -> Performs ransomware-like behavior -> Terminate process

Correct Answer: C

QUESTION NO: 6
An administrator needs to check configurations using Audit across several policies and locations within the organization.
How can the administrator run the query to only these specific devices?

A. Specify endpoints on the query by selecting the check box for each device. B. Specify endpoints on the query by typing the sensor name into the text box, selecting the device. Repeat as necessary for all devices. C. Specify the policy for the endpoints on the query, and then type the sensor name into the text box, selecting the devices. Repeat as necessary for all devices. D. Specify the policy for the endpoints on the query, and then select the check box for each device.

Correct Answer: C

QUESTION NO: 7
Which Live Query statement is properly constructed?

A. select from users; B. select * from *: C. SELECT * FROM 'users' D. SELECT * FROM users;

Correct Answer: D