• ホーム
  • ブログ
  • 究極のガイド準備5V0-93.22認証試験VMware Security Solutionsは2024年更新 [Q17-Q40]

究極のガイド準備5V0-93.22認証試験VMware Security Solutionsは2024年更新 [Q17-Q40]

Share

究極のガイド準備5V0-93.22認証試験VMware Security Solutionsは2024年更新

リアル5V0-93.22問題集でVMware正確なアンサーは最新問題は2024年更新


VMware Carbon Black Cloud プラットフォームは、高度な脅威検出および対応機能を提供する主要なエンドポイントセキュリティソリューションです。人工知能と機械学習を使用して、マルウェア、ランサムウェア、およびその他のサイバー脅威をリアルタイムで特定およびブロックします。VMware 5V0-93.22 試験は、個人が VMware Carbon Black Cloud Endpoint Standard をインストール、構成、および管理する能力をテストすることに焦点を当てています。

 

質問 # 17
An administrator wants to block an application by its path instead of reputation. The following steps have already been taken:
Go to Enforce > Policies > Select the desired policy >
Which additional steps must be taken to complete the task?

  • A. Click Enforce > Add application path name
  • B. Scroll down to the Blocking and Isolation section > Click Edit (pencil icon) for the desired Reputation
  • C. Scroll down to the Permissions section > Click Add application path > Enter the path of the desired application
  • D. Scroll down to the Blocking and Isolation section > Click Add application path > Enter the path of the desired application

正解：D

解説：
To block an application by its path instead of reputation, the administrator needs to follow these steps:
Go to Enforce > Policies > Select the desired policy.
Scroll down to the Blocking and Isolation section.
Click Add application path.
Enter the path of the desired application, such as C:\Program Files\Example\example.exe.
Choose the action to take when the application is detected, such as Block or Allow.
Optionally, add a description for the application path rule.
Click Save to apply the changes to the policy.
The other options are incorrect because they do not specify the correct section, button, or field for blocking an application by its path. The Enforce section is for managing the policy assignments, not the policy rules. The Permissions section is for managing the application control rules, not the application blocking rules. The Edit (pencil icon) button is for modifying the existing reputation levels, not for adding a new application path rule. References:
VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Module 3: Application Control, pages 3-7 to 3-8.
VMware Carbon Black Cloud Endpoint Standard User Guide, Chapter 9: Application Control, pages
115-116.


質問 # 18
In which tab of the VMware Carbon Black Cloud interface can sensor status details be found?

  • A. Inventory > Sensors
  • B. Inventory > Sensor groups
  • C. Enforce > Policies
  • D. Inventory > Endpoints

正解：D

解説：
Explanation
The sensor status details can be found in the Inventory > Endpoints tab of the VMware Carbon Black Cloud interface. This tab displays all the deployed sensors by default, and allows the administrator to filter them by various criteria, such as status, policy, group, OS, or device name. The status column indicates the state of a sensor and any administrator actions that have been taken on the sensor, such as bypass, quarantine, or deregister. The administrator can also view more details about a sensor by clicking on its name, such as the sensor version, last check-in time, device health score, and policy history. The administrator can also take actions on a sensor from this tab, such as updating, isolating, or uninstalling the sensor. References: Sensor Status and Details - Asset Groups, Carbon Black Cloud Endpoint Standard - Technical Overview


質問 # 19
An administrator has just placed an endpoint into bypass.
What type of protection, if any, will VMware Carbon Black provide this device?

  • A. VMware Carbon Black will apply policy rules.
  • B. VMware Carbon Black will be uninstalled from the endpoint.
  • C. VMware Carbon Black will not provide any protection to the endpoint.
  • D. VMware Carbon Black will place the machine in quarantine.

正解：C

解説：
Explanation
When an administrator places an endpoint into bypass mode, VMware Carbon Black Cloud Endpoint Standard will not provide any protection to the endpoint. Bypass mode is a feature that allows the administrator to disable all policy rule enforcement on the endpoint, which means that the endpoint is not actively protected by VMware Carbon Black Cloud Endpoint Standard. The sensor will ignore any malicious or suspicious activity on the endpoint and will not log any events or send any data to the Carbon Black Cloud console. The administrator can use bypass mode to troubleshoot application interoperability, bootup, or login issues on the endpoint, or to upgrade the operating system on the endpoint. The administrator can enable or disable bypass mode from the Carbon Black Cloud console, the sensor UI, or the command line. The administrator can also view the reason and duration of the bypass mode from the Carbon Black Cloud console12.
The other options are incorrect or irrelevant. VMware Carbon Black Cloud Endpoint Standard will not be uninstalled from the endpoint when it is placed into bypass mode. The sensor will still be running on the endpoint, but it will not enforce any policy rules. VMware Carbon Black Cloud Endpoint Standard will not place the machine in quarantine when it is placed into bypass mode. Quarantine is a different feature that allows the administrator to isolate the endpoint from the network, preventing any communication with other devices or external servers. VMware Carbon Black Cloud Endpoint Standard will not apply policy rules when the endpoint is placed into bypass mode. Policy rules are the settings that define how the sensor detects and prevents threats on the endpoint. Bypass mode disables all policy rule enforcement on the endpoint.
References:
Sensor Bypass Mode - VMware Docs, Overview section.
Carbon Black Cloud: How to Get Started With Bypass Mode - Carbon Black Community, Objective section.


質問 # 20
An administrator has been tasked with preventing the use of unauthorized USB storage devices from being used in the environment.
Which item needs to be enabled in order to enforce this requirement?

  • A. Elect to approve only allowed USB devices from the USB Devices page.
  • B. Select the option to block USB devices from the Reputation page.
  • C. Choose to disable USB device access on each endpoint from the Inventory page.
  • D. Enable the Block access to all unapproved USB devices within the policies option.

正解：D


質問 # 21
A security administrator notices an unusual software behavior on an endpoint. The administrator immediately used the search query to collect data and start analyzing indicators to find the solution.
What is a pre-requisite step in gathering specific vulnerability data to export it as a CSV file for analysis?

  • A. Enable cloud analysis.
  • B. Perform a custom search on the Endpoint Page.
  • C. Access the Audit Log content to see associated events.
  • D. Search for specific malware byhash or filename.

正解：B


質問 # 22
The use of leading wildcards in a query is not recommended unless absolutely necessary because they carry a significant performance penalty for the search.
What is an example of a leading wildcard?

  • A. filemod:system32/*ntdll.dll
  • B. filemod:*/system32/ntdll.dll
  • C. filemod:system32/ntdll.dll
  • D. filemod:system32/ntdll.dll*

正解：B

解説：
Explanation
A leading wildcard is a wildcard that is placed at the beginning of a search term, such as * or ?. A leading wildcard matches any characters that precede the specified term. For example, filemod:/system32/ntdll.dll matches any file modification events that end with /system32/ntdll.dll, regardless of the drive letter or the directory name. A leading wildcard is not recommended unless absolutely necessary because it carries a significant performance penalty for the search. This is because the search engine has to scan the entire index for possible matches, rather than using the index to quickly narrow down the results1.
The other options are not examples of leading wildcards. A. filemod:system32/ntdll.dll is an exact match query that matches only file modification events that are exactly system32/ntdll.dll. B. filemod:system32/ ntdll.dll is a trailing wildcard query that matches any file modification events that start with system32/ and end with ntdll.dll, regardless of the characters in between. D. filemod:system32/ntdll.dll is a trailing wildcard query that matches any file modification events that start with system32/ntdll.dll, regardless of the characters that follow. References:
Search Syntax - VMware Docs, Wildcards section.


質問 # 23
An administrator needs to make sure all files are scanned locally upon execution.
Which setting is necessary to complete this task?

  • A. Run Background Scan must be set to Expedited.
  • B. Allow Signature Updates must be enabled.
  • C. Signature Update frequency must be set to 2 hours.
  • D. On-Access File Scan Mode must be set to Aggressive.

正解：D


質問 # 24
Which statement accurately characterizes Alerts that are categorized as a "Threat" versus those categorized as
"Observed"?

  • A. "Threat" indicates that no block (Deny or Terminate) has occurred. "Observed" indicates a block.
  • B. "Threat" indicates a more likely malicious event. "Observed" are less likely to be malicious.
  • C. "Threat" indicates an ongoing attack. "Observed" indicates the attack is over and is being watched.
  • D. "Threat" indicates a block (Deny or Terminate) has occurred. "Observed" indicates that there is no block.

正解：B

解説：
Explanation
According to the VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, alerts are categorized as either "Threat" or "Observed" based on the severity and confidence of the event. "Threat" alerts indicate a high-severity and high-confidence event that is more likely to be malicious, such as a ransomware attack, a credential theft, or a network beacon. "Observed" alerts indicate a low-severity and low-confidence event that is less likely to be malicious, such as a suspicious registry modification, a fileless script execution, or a process injection. The categorization of alerts helps analysts prioritize their investigations and responses. References: VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, page 14, section 2.3.1. Alert Categories. [Link]


質問 # 25
Which port does the VMware Carbon Black sensor use to communicate to VMware Carbon Black Cloud?

  • A. 0
  • B. 1
  • C. 2
  • D. 3

正解：C

解説：
Explanation
The VMware Carbon Black sensor uses port 443 by default to communicate with the VMware Carbon Black Cloud. This port is used for both incoming and outgoing TCP connections to the environment-specific URLs that provide console access, API requests, sensor communication, UBS download, signature update, third-party certificate validation, and Live Response uploads. Port 54443 is used as a backup port in case port
443 is blocked or unavailable. Ports 80 and 22 are not used by the VMware Carbon Black sensor. References: Configure a Firewall, Ports and URLs


質問 # 26
An organization has found application.exe running on some machines in their Workstations policy.
Application.exe has a SUSPECT_MALWARE reputation and runs from C:\Program Files\IT\Tools. The Workstations policy has the following rules which could apply:
Blocking and Isolation Rule
Application on the company banned list > Runs or is running > Deny
Known malware > Runs or is running > Deny
Suspect malware > Runs or is running > Terminate
Permissions Rule
C:\Program Files\IT\Tools\* > Performs any operation > Bypass
Which action, if any, should an administrator take to ensure application.exe cannot run?

  • A. Remove the Permissions rule for C:\Program FilesMTVToolsV.
  • B. Add the hash to the company banned list at a higher priority.
  • C. No action needs to be taken as the file will be blocked based on reputation alone.
  • D. Change the reputation to KNOWN MALWARE to a higher priority.

正解：A

解説：
Explanation
The action that an administrator should take to ensure application.exe cannot run is to remove the Permissions rule for C:\Program Files\IT\Tools*. This is because the Permissions rule has a higher priority than the Blocking and Isolation rule, and it allows any operation on any file in that path, including application.exe. By removing the Permissions rule, the Blocking and Isolation rule will apply and terminate application.exe based on its SUSPECT_MALWARE reputation. The other options are incorrect because they will not prevent application.exe from running. Option A is incorrect because changing the reputation to KNOWN MALWARE will not override the Permissions rule that allows any operation on the file. Option B is incorrect because the file will not be blocked based on reputation alone, as the Permissions rule will bypass the reputation check.
Option D is incorrect because adding the hash to the company banned list will not override the Permissions rule that allows any operation on the file. References: Precedence of Policy Rules, Set Permission Policy Rules, Set Blocking and Isolation Policy Rules


質問 # 27
A company wants to prevent an executable from running in their organization. The current reputation for the file is NOT LISTED, and the machines are in the default standard policy.
Which action should be taken to prevent the file from executing?

  • A. Add the hash to the MALWARE list.
  • B. Use Live Response to kill the process.
  • C. Use Live Response to delete the file.
  • D. Add the hash to the company banned list.

正解：D


質問 # 28
An administrator has determined that the following rule was the cause for an unexpected block:
[Suspected malware] [Invokes a command interpreter] [Terminate process] All reputations for the process which was blocked show SUSPECT_MALWARE.
Which reputation was used by the sensor for the decision to terminate the process?

  • A. Effective reputation
  • B. Initial Cloud reputation
  • C. Actioned reputation
  • D. Current Cloud reputation

正解：A

解説：
Explanation
The reputation that was used by the sensor for the decision to terminate the process was the effective reputation. The effective reputation is the reputation that the sensor uses to evaluate and enforce policy rules on the endpoint. The effective reputation is determined by the following factors:
The initial cloud reputation, which is the reputation that the Carbon Black Cloud assigns to the file based on its analysis and threat intelligence feeds.
The actioned reputation, which is the reputation that the administrator assigns to the file through the Carbon Black Cloud console, such as approve, ban, or dismiss.
The current cloud reputation, which is the reputation that the Carbon Black Cloud updates for the file based on new information or changes in the threat landscape.
The effective reputation is the highest priority reputation among these three factors. For example, if the initial cloud reputation is SUSPECT_MALWARE, the actioned reputation is APPROVED, and the current cloud reputation is KNOWN_MALWARE, the effective reputation will be APPROVED, because it has the highest priority. The sensor will use the effective reputation to apply the policy rules on the endpoint. In this case, the process will not be blocked by the rule [Suspected malware] [Invokes a command interpreter] [Terminate process], because the effective reputation is not SUSPECT_MALWARE.
In the question scenario, the effective reputation for the process was SUSPECT_MALWARE, which means that either the initial cloud reputation, the actioned reputation, or the current cloud reputation was SUSPECT_MALWARE, and there was no higher priority reputation that overrode it. Therefore, the sensor used the effective reputation to enforce the policy rule and terminate the process. References:
Endpoint Standard: How to Confirm Applied ... - VMware Carbon Black, Resolution section.


質問 # 29
Which statement is true regarding Blocking/Isolation rules and Permission rules?

  • A. Upload Rules are overridden by Blocking & Isolation rules.
  • B. Permission Rules are overridden by Blocking & Isolation rules
  • C. D.Blocking & Isolation rules are overridden by Permission Rules
  • D. Blocking & Isolation rules are overridden by Upload Rules.

正解：C

解説：
Explanation
The correct statement regarding Blocking/Isolation rules and Permission rules is D. Blocking & Isolation rules are overridden by Permission Rules. This means that if a file or process matches both a Blocking/Isolation rule and a Permission rule, the action specified by the Permission rule will take precedence over the action specified by the Blocking/Isolation rule. For example, if a file has a reputation of SUSPECT_MALWARE and a Blocking/Isolation rule is set to terminate any SUSPECT_MALWARE file that runs, but a Permission rule is set to allow and log any file that runs from a specific path, the file will be allowed and logged if it runs from that path, regardless of its reputation. Permission rules are useful for tuning the behavior of VMware Carbon Black Cloud Endpoint Standard and preventing false positives or unnecessary blocks1.
The other statements are false or irrelevant. Blocking & Isolation rules are not overridden by Upload Rules.
Upload Rules are rules that specify which files and metadata are uploaded to the Carbon Black Cloud for analysis and reputation. Upload Rules do not affect the prevention or detection capabilities of VMware Carbon Black Cloud Endpoint Standard2. Permission Rules are not overridden by Blocking & Isolation rules. As explained above, Permission Rules have a higher priority than Blocking & Isolation rules and can override their actions. Upload Rules are not overridden by Blocking & Isolation rules. Upload Rules and Blocking & Isolation rules are independent of each other and do not affect each other's functionality. References:
Prevention Policy Settings - VMware Docs, Permissions section, Action subsection.
Upload Rules - VMware Docs, Overview section.


質問 # 30
An administrator notices that a sensor's local AV signatures are out-of-date.
What effect does this have on newly discovered files?

  • A. The sensor automatically blocks the new file.
  • B. The reputation is determined by cloud reputation.
  • C. The sensor prompts the end user to allow or deny the file.
  • D. The sensor is unable to block a malicious file.

正解：B


質問 # 31
An administrator has been tasked with preventing the use of unauthorized USB storage devices from being used in the environment.
Which item needs to be enabled in order to enforce this requirement?

  • A. Enable the Block access to all unapproved USB devices within the policies option.
  • B. Elect to approve only allowed USB devices from the USB Devices page.
  • C. Select the option to block USB devices from the Reputation page.
  • D. Choose to disable USB device access on each endpoint from the Inventory page.

正解：B

解説：
Explanation
To prevent the use of unauthorized USB storage devices, the administrator needs to enable the USB Device Control feature in the VMware Carbon Black Cloud Endpoint Standard. This feature allows the administrator to approve or block specific USB devices based on their vendor ID, product ID, serial number, and device type. The administrator can also set a default action for unapproved USB devices, such as block, read-only, or allow. The administrator can manage the USB devices from the USB Devices page under the Settings menu. From this page, the administrator can view the list of USB devices that have been detected by the endpoints, and elect to approve only the allowed USB devices. The administrator can also export or import the list of approved USB devices for backup or replication purposes. References:
VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Module 4: USB Device Control, pages 4-1 to 4-9.
VMware Carbon Black Cloud Endpoint Standard User Guide, Chapter 11: USB Device Control, pages
147-152.


質問 # 32
A security administrator is tasked to enable Live Response on all endpoints in a specific policy.
What is the correct path to configure the required sensor policy setting?

  • A. Policies > Policy > Sensor > Enforce
  • B. Enforce > Policies > Policy > Sensor
  • C. Enforce > Policy > Policies > Sensor
  • D. Policies > Enforce > Policy > Sensor

正解：B

解説：
Explanation
To enable Live Response on all endpoints in a specific policy, the security administrator needs to follow the correct path to configure the required sensor policy setting. The correct path is Enforce > Policies > Policy > Sensor. This path allows the administrator to select a policy group, then click on the Sensor tab, where they can select or deselect the Enable Live Response checkbox as applicable, and then click Save. This will enable or disable Live Response for all endpoints that are assigned to that policy group. The other options are incorrect because they do not match the correctpath to configure the sensor policy setting for Live Response. References: Use Live Response, Use Live Response for VM Workloads


質問 # 33
Which statement is true regarding Blocking/Isolation rules and Permission rules?

  • A. Permission Rules are overridden by Blocking & Isolation rules
  • B. Upload Rules are overridden by Blocking & Isolation rules.
    D Blocking & Isolation rules are overridden by Permission Rules
  • C. Blocking & Isolation rules are overridden by Upload Rules.

正解：A


質問 # 34
What is a security benefit of VMware Carbon Black Cloud Endpoint Standard?

  • A. Customized threat feeds can be combined with other outside threat intelligence sources.
  • B. Firewall rule configuration are provided in the environment.
  • C. Data leakage protection (DLP) is enforced on endpoints or subsets of endpoints.
  • D. Events and alerts are tagged with Carbon Black TTPs to provide context around attacks.

正解：D


質問 # 35
An administrator is tasked to create a reputation override for a company-critical application based on the highest available priority in the reputation list. The company-critical application is already known by VMware Carbon Black.
Which method of reputation override must the administrator use?

  • A. Signing Certificate
  • B. Hash
  • C. IT Tool
  • D. Local Approved

正解：A


質問 # 36
The VMware Carbon Black Cloud Sensor is not able to establish connectivity to the VMware Carbon Black Cloud Content Management URL over the standard SSL port TCP/443.
Which port, if any, will be the tailback?

  • A. TCP/8443
  • B. It will not fallback and fail.
  • C. TCP/80
  • D. TCP/54443

正解：A


質問 # 37
An administrator is tasked to create a reputation override for a company-critical application based on the highest available priority in the reputation list. The company-critical application is already known by VMware Carbon Black.
Which method of reputation override must the administrator use?

  • A. Hash
  • B. Local Approved
  • C. IT Tool
  • D. Signing Certificate

正解：C

解説：
Explanation
To create a reputation override for a company-critical application based on the highest available priority in the reputation list, the administrator must use the IT Tool method of reputation override. The IT Tool method allows the administrator to specify a path to a known IT tool application, such as C:\Program Files\IT\Tools\application.exe, and assign it the Local Approved reputation. This reputation is the highest priority in the reputation list and overrides any other reputations assigned by VMware Carbon Black or other sources. The IT Tool method is useful for applications that are already known by VMware Carbon Black, but need to be allowed to run without interference from the sensor. The other options are incorrect because they are not the highest priority in the reputation list. Option A is incorrect because the Signing Certificate method assigns the Company Approved reputation, which is lower than the Local Approved reputation. Option B is incorrect because the Hash method assigns the Company Approved or Company Banned reputation, depending on the action selected, which are lower than the Local Approved reputation. Option C is incorrect because the Local Approved method is not a valid method of reputation override. It is a reputation level that can be assigned by the IT Tool method or by the sensor for pre-existing files or files signed by a trusted certificate. References: Manage Reputations, Reputation Assignment


質問 # 38
An administrator needs to make sure all files are scanned locally upon execution.
Which setting is necessary to complete this task?

  • A. Run Background Scan must be set to Expedited.
  • B. Allow Signature Updates must be enabled.
  • C. Signature Update frequency must be set to 2 hours.
  • D. On-Access File Scan Mode must be set to Aggressive.

正解：D

解説：
Explanation
To make sure all files are scanned locally upon execution, the administrator needs to set the On-Access File Scan Mode to Aggressive. This setting will scan all files on execute, regardless of whether they are new or pre-existing on the device. The assigned reputation and policy rules will apply to the scanned files. The other options are incorrect because they are not necessary to complete this task. Option B is incorrect because the Signature Update frequency is not related to the local scanning of files upon execution. It is related to how often the sensor checks in for signature pack updates. Option C is incorrect because the Allow Signature Updates is not related to the local scanning of files upon execution. It is related to enabling or disabling signature updates for the scanner. Option D is incorrect because the Run Background Scan is not related to the local scanning of files upon execution. It is related to enabling or disabling a one-time background scan on any endpoint sensorassigned to a policy. References: Configure Local Scan Settings, Endpoint Standard: How To Configure Local AV Scan


質問 # 39
A security administrator needs to review the Live Response activities and commands that have been executed while performing a remediation process to the sensors.
Where can the administrator view this information in the console?

  • A. Notifications
  • B. Users
  • C. Audit Log
  • D. Inbox

正解：C


質問 # 40
......


VMware 5V0-93.22認定試験は、IT専門家がVMware Carbon Black Cloud Technologiesを使用してエンドポイントセキュリティのスキルと知識を認識する絶好の機会です。この認定は、雇用市場で競争力を提供し、エンドポイント保護に関する候補者の専門知識を検証します。認定試験では、カーボンブラッククラウドエンドポイント保護に関連するさまざまなトピックをカバーしているため、組織のエンドポイントの確保を担当するIT担当者にとって包括的かつ価値のある認証となっています。


この試験は、ポリシー管理に焦点を当てています。 このセクションでは、エンドポイントセキュリティのポリシーを作成および管理する能力についてテストされます。 また、プロセスブロッキングポリシーやイベントベースのポリシーなど、さまざまなポリシータイプに関する知識についてテストされます。 4番目の最終セクションでは、調査と修復のスキルをテストします。 このセクションでは、エンドポイントの脅威を調査し、それらを修復する能力についてテストされます。

 

VMware Security Solutions 5V0-93.22試験練習問題集：https://www.passtest.jp/VMware/5V0-93.22-shiken.html

5V0-93.22プレミアム資料テストPDFで無料問題集お試しセット：https://drive.google.com/open?id=1JnPfJ0zBDmANEuBy2qYyArjcy7hgT76b

関するブログ

もっと
5V0-93.22 無料問題集