VMware Carbon Black Cloud Endpoint Standard Skills (5V0-93.22) Free Practice Test

Question 1

A security administrator is tasked to investigate an alert about a suspicious running process trying to modify a system registry.
Which components can be checked to further inspect the cause of the alert?

A. Command lines. Device ID, and priority score

B. Priority score, file reputation, and timestamp

C. TTPs involved, network connections, and child path

D. Event details, command lines, and TTPs involved

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

An administrator would like to proactively know that something may get blocked when putting a policy rule in the environment.
How can this information be obtained?

A. Search the data using the test rule functionality.
B Examine log files to see what would be impacted

B. Put the rules in and see what happens to the endpoints.
D Determine what would happen based on previously used antivirus software

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

An administrator needs to configure a policy for macOS and Linux Sensors, not enabling settings which are only applicable to Windows.
Which three settings are only applicable to Sensors on the Windows operating system? (Choose three.)

A. Expedited background scan

B. Scan execute on network drives
F Require code to uninstall sensor

C. Submit unknown binaries for analysis

D. Delay execute for cloud scan

E. Allow user to disable protection

Correct Answer: A,B,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

An administrator has been tasked with preventing the use of unauthorized USB storage devices from being used in the environment.
Which item needs to be enabled in order to enforce this requirement?

A. Elect to approve only allowed USB devices from the USB Devices page.

B. Choose to disable USB device access on each endpoint from the Inventory page.

C. Enable the Block access to all unapproved USB devices within the policies option.

D. Select the option to block USB devices from the Reputation page.

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

An administrator wants to block an application by its path instead of reputation. The following steps have already been taken:
Go to Enforce > Policies > Select the desired policy >
Which additional steps must be taken to complete the task?

A. Click Enforce > Add application path name

B. Scroll down to the Blocking and Isolation section > Click Add application path > Enter the path of the desired application

C. Scroll down to the Blocking and Isolation section > Click Edit (pencil icon) for the desired Reputation

D. Scroll down to the Permissions section > Click Add application path > Enter the path of the desired application

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

In which tab of the VMware Carbon Black Cloud interface can sensor status details be found?

A. Inventory > Sensor groups

B. Inventory > Endpoints

C. Enforce > Policies

D. Inventory > Sensors

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

A recent application has been blocked using hash ban, which is an indicator that some users attempted an unexpected activity. Even though the activity was blocked, the security administrator wants to further investigate the attempt in VMware Carbon Black Cloud Endpoint Standard.
Which page should the administrator navigate to for a graphical view of the event?

A. Audit Log

B. Alert Triage

C. Watchlists

D. Process Analysis

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

VMware Carbon Black Cloud Endpoint Standard Skills (5V0-93.22) Free Practice Test