5V0-91.20問題集、VMware実際の試験問題

質問 1

An administrator needs to query all endpoints in the HR group for instances of an obfuscated copy of cmd.exe.
Given this Enterprise EDR query:
process_name:cmd.exe AND device_group:HR AND NOT enriched:true
Which example could be added to the query to provide the desired results?

A. NOT process_name:cmd.exe

B. NOT process_internal_name:cmd.exe

C. NOT process_original_filename:cmd.exe

D. NOT process_company_name:cmd.exe

正解: A

質問 2

Which Live Query statement is properly constructed?

A. SELECT * FROM users;

B. SELECT * FROM 'users'

C. select from users;

D. select * from *:

正解: A

質問 3

An analyst has investigated multiple alerts on a number of HR workstations and found that java.exe is attempting to PowerShell. Of the Windows workstations in question, the analyst has also found that Java is installed in multiple locations. The analyst needs to block java.exe from this type of operation.
Which rule meets this need?

A. **/java.exe -> Invokes an untrusted process -> Terminate process

B. **\Program Files\*\java.exe -> Invokes a command interpreter -> Terminate process

C. **/Program Files/*/java.exe-> Invokes an untrusted process -> Deny operation

D. **\java.exe -> Invokes a command interpreter -> Deny operation

正解: B

質問 4

Which statement should be used when constructing queries in Carbon Black Audit and Remediation, Live Query?

A. ALTER

B. REMOVE

C. SELECT

D. UPDATE

正解: C

質問 5

A watchlist generates a false positive on the Triage Alerts page, so the watchlist must be updated.
How should this task be accomplished?

A. One can update watchlists from the Process Search Page.

B. Open the Watchlist Page and click the pencil button associated with the watchlist.

C. One can update watchlists directly on the Triage Alerts Page using the pencil icon.

D. Open the process analysis page and select the Add Watchlist Exclusion option from the Actions menu.

正解: C

質問 6

What does the Aggressive setting do when configured in Local Scan Settings?

A. It adds a temporary reputation.

B. It scans new files on first execution.

C. It enables signature updates for the scanner.

D. It scans all files on execution.

正解: B

質問 7

An active compromise is detected on an endpoint. Due to current policies, the compromise was detected but not terminated.
What would be an appropriate action to end the current communication between the device and the attacker?

A. Place the system into Quarantine

B. Uninstall the sensor

C. Remotely scan the endpoint

D. Place the system into bypass mode

正解: D

VMware Carbon Black Portfolio Skills - 5V0-91.20 模擬練習