VMware Carbon Black Cloud Endpoint Standard Skills - 5V0-93.22 Exam Questions
QUESTION NO: 1
An administrator needs to find all events on the Investigate page where the process is svchost.exe, and the path is not the standard path of C:\Windows\System32.
Which advanced search will yield these results?
An administrator needs to find all events on the Investigate page where the process is svchost.exe, and the path is not the standard path of C:\Windows\System32.
Which advanced search will yield these results?
Correct Answer: B
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 2
An administrator notices that a sensor's local AV signatures are out-of-date.
What effect does this have on newly discovered files?
An administrator notices that a sensor's local AV signatures are out-of-date.
What effect does this have on newly discovered files?
Correct Answer: D
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 3
Which statement accurately characterizes Alerts that are categorized as a "Threat" versus those categorized as
"Observed"?
Which statement accurately characterizes Alerts that are categorized as a "Threat" versus those categorized as
"Observed"?
Correct Answer: B
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 4
Is it possible to search for unsigned files in the console?
Is it possible to search for unsigned files in the console?
Correct Answer: B
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 5
Which VMware Carbon Black Cloud integration is supported for SIEM?
Which VMware Carbon Black Cloud integration is supported for SIEM?
Correct Answer: A
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 6
An administrator wants to prevent malicious code that has not been seen before from retrieving credentials from the Local Security Authority Subsystem Service, without causing otherwise good applications from being blocked.
Which rule should be used?
An administrator wants to prevent malicious code that has not been seen before from retrieving credentials from the Local Security Authority Subsystem Service, without causing otherwise good applications from being blocked.
Which rule should be used?
Correct Answer: D
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 7
An administrator wants to prevent a spreadsheet from being misused to run malicious code, while minimizing the risk of breaking normal operations of a spreadsheet.
Which rule should be used?
An administrator wants to prevent a spreadsheet from being misused to run malicious code, while minimizing the risk of breaking normal operations of a spreadsheet.
Which rule should be used?
Correct Answer: D
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
