The administrator has configured a permission rule with the following options selected:Application at path: C:\Users\*\Downloads\**Operation Attempt: Performs any operationAction: BypassWhat is the impact, if any, of using the wildcards in the path for this rule?

Any executable in the downloads directory for any user on the system will be bypassed for inspection.

Any executable in the downloads directory for any user on the system will be logged and allowed to execute.

No files will be ignored from the downloads directory.

Any executable in the downloads directory for any user on the system will be bypassed for inspection.

Any executable in the downloads directory will be prevented from executing.

An administrator wants to prevent malicious code that has not been seen before from retrieving credentials from the Local Security Authority Subsystem Service, without causing otherwise good applications from being blocked.Which rule should be used?

[Not listed application] [Scrapes memory of another process] [Terminate process]

[Unknown application] [Retrieves credentials] [Terminate process]

[**/*.exe] [Scrapes memory of another process] [Terminate process]

[**\lsass.exe] [Scrapes memory of another process] [Deny operation]

[Not listed application] [Scrapes memory of another process] [Terminate process]

An administrator wants to prevent a spreadsheet from being misused to run malicious code, while minimizing the risk of breaking normal operations of a spreadsheet.Which rule should be used?

**\excel.exe [Invokes a command interpreter] [Deny operation]

**\Microsoft Office\** [Runs external code] [Terminate process]

**\excel.exe [Invokes a command interpreter] [Deny operation]

**/Microsoft Excel.app/** [Communicates over the network] [Terminate process]

**\excel.exe [Runs malware] [Deny operation]

What is a capability of VMware Carbon Black Cloud?

Attack chain visualization and search

Continuous and decentralized recording

Attack chain visualization and search

Automation via closed SOAP APIs

A security administrator notices an unusual software behavior on an endpoint. The administrator immediately used the search query to collect data and start analyzing indicators to find the solution.What is a pre-requisite step in gathering specific vulnerability data to export it as a CSV file for analysis?

Perform a custom search on the Endpoint Page.

Access the Audit Log content to see associated events.

Search for specific malware by hash or filename.

Which statement is true regarding Blocking/Isolation rules and Permission rules?

Permission Rules are overridden by Blocking & Isolation rules

Blocking & Isolation rules are overridden by Upload Rules.

Permission Rules are overridden by Blocking & Isolation rules

Upload Rules are overridden by Blocking & Isolation rules.

Blocking & Isolation rules are overridden by Permission Rules

An administrator has been tasked with preventing the use of unauthorized USB storage devices from being used in the environment.Which item needs to be enabled in order to enforce this requirement?

Enable the Block access to all unapproved USB devices within the policies option.

Choose to disable USB device access on each endpoint from the Inventory page.

Select the option to block USB devices from the Reputation page.

Elect to approve only allowed USB devices from the USB Devices page.

What connectivity is required for VMware Carbon Black Cloud Endpoint Standard to perform Sensor Certificate Validation?

TCP/443 to GoDaddy OCSP and CRL URLs (crl.godaddy.com and ocsp.godaddy.com)

TCP/80 to GoDaddy OCSP and CRL URLs (crl.godaddy.com and ocsp.godaddy.com)

TCP/443 to GoDaddy CRL URL (crl.godaddy.com and ocsp.godaddy.com)

TCP/80 to GoDaddy CRL URL (crl.godaddy.com and ocsp.godaddy.com)

An administrator wants to block an application by its path instead of reputation. The following steps have already been taken:Go to Enforce > Policies > Select the desired policy >Which additional steps must be taken to complete the task?

Scroll down to the Blocking and Isolation section > Click Add application path > Enter the path of the desired application

Click Enforce > Add application path name

Scroll down to the Permissions section > Click Add application path > Enter the path of the desired application

Scroll down to the Blocking and Isolation section > Click Edit (pencil icon) for the desired Reputation

Scroll down to the Blocking and Isolation section > Click Add application path > Enter the path of the desired application

A user downloaded and executed malware on a system. The malware is actively exfiltrating data.Which immediate action is recommended to prevent further exfiltration?

Place the device in quarantine.

Check Security Advisories and Threat Research contents.

Place the device in quarantine.

Request upload of the file for analysis.

What are the highest and lowest file reputation priorities, respectively, in VMware Carbon Black Cloud?

Priority 1: Ignore, Priority 11: Unknown

Priority 1: Unknown, Priority 11: Ignore

Priority 1: Known Malware, Priority 11: Common White

Priority 1: Company Allowed, Priority 11: Not Listed/Adaptive White

An administrator wants to find information about real-world prevention rules that can be used in VMware Carbon Black Cloud Endpoint Standard.How can the administrator obtain this information?

Refer to the TAU-TIN's on the VMware Carbon Black community page.

Refer to an external report from other security vendors to obtain solutions.

Refer to the TAU-TIN's on the VMware Carbon Black community page.

Refer to the VMware Carbon Black Cloud sensor install guide.

Refer to VMware Carbon Black Cloud user guide.

Is it possible to search for unsigned files in the console?

Yes, by using the search: process_publisher_state:FILE_SIGNATURE_STATE_UNSIGNED

Yes, by using the search: NOT process_publisher_state:FILE_SIGNATURE_STATE_SIGNED

No, it is not possible to return a query for unsigned files.

Yes, by using the search: process_publisher_state:FILE_SIGNATURE_STATE_UNSIGNED

Yes, by looking at signed and unsigned executables in the environment and seeing if another difference can be found, thus locating unsigned files in the environment.

The administrator has configured a permission rule with the following options selected:Application at path: C:\Program Files\**Operation Attempt: Performs any operationAction: BypassWhat is the impact, if any, of using the wildcards in the application at path field?

Executable files in the 'Program Files' directory and subdirectories will be ignored.

Executable files in the 'Program Files' directory will be blocked.

Executable files in the 'Program Files' directory will be logged.

Executable files in the 'Program Files' directory will be subject to blocking rules.

An administrator would like to proactively know that something may get blocked when putting a policy rule in the environment.How can this information be obtained?

Search the data using the test rule functionality.

Examine log files to see what would be impacted

Put the rules in and see what happens to the endpoints.

Determine what would happen based on previously used antivirus software

An administrator has just placed an endpoint into bypass.What type of protection, if any, will VMware Carbon Black provide this device?

VMware Carbon Black will not provide any protection to the endpoint.

VMware Carbon Black will be uninstalled from the endpoint.

VMware Carbon Black will place the machine in quarantine.

VMware Carbon Black will not provide any protection to the endpoint.

VMware Carbon Black will apply policy rules.

Which statement accurately characterizes Alerts that are categorized as a 'Threat' versus those categorized as 'Observed'?

'Threat' indicates a more likely malicious event. 'Observed' are less likely to be malicious.

'Threat' indicates an ongoing attack. 'Observed' indicates the attack is over and is being watched.

'Threat' indicates a more likely malicious event. 'Observed' are less likely to be malicious.

'Threat' indicates a block (Deny or Terminate) has occurred. 'Observed' indicates that there is no block.

'Threat' indicates that no block (Deny or Terminate) has occurred. 'Observed' indicates a block.

An organization has the following requirements for allowing application.exe:For example, on one user's machine, the path is C:\Users\Lorie\Temp\Allowed\application.exe.Which path meets this criteria using wildcards?

C:\Users\*\Temp\Allowed\application.exe

C:\Users\?\Temp\Allowed\application.exe

C:\Users\*\Temp\Allowed\application.exe

*:\Users\**\Temp\Allowed\application.exe

*:\Users\*\Temp\Allowed\application.exe

Where can a user identify whether a sensor's signature pack is out-of-date in VMware Carbon Black Cloud?

Inventory > Endpoints > Sensor Update Status

Enforce > Investigate > Sensors > Details

Enforce > Inventory > Endpoints > Policy

Inventory > Endpoints > Sensor Update Status

Inventory > Endpoints > Device Name

A security administrator is tasked to investigate an alert about a suspicious running process trying to modify a system registry.Which components can be checked to further inspect the cause of the alert?

Event details, command lines, and TTPs involved

Command lines. Device ID, and priority score

Event details, command lines, and TTPs involved

TTPs involved, network connections, and child path

Priority score, file reputation, and timestamp

An administrator wants to be notified when particular Tactics, Techniques, or Procedures (TTPs) are observed on a managed endpoint.Which notification option must the administrator configure to receive this notification?

Alert that crosses a threshold with the 'observed' option selected

Alert that includes specific TTPs

Policy action that is enforced with the 'deny' opt ion selected

An administrator needs to configure a policy for macOS and Linux Sensors, not enabling settings which are only applicable to Windows.Which three settings are only applicable to Sensors on the Windows operating system? (Choose three.)

Require code to uninstall sensor

Allow user to disable protection

Submit unknown binaries for analysis

Require code to uninstall sensor

An administrator has configured a terminate rule to prevent an application from running. The administrator wants to confirm that the new rule would have prevented a previous execution that had been observed.Which feature should the administrator leverage for this purpose?

Utilize the Test rule link from within the rule.

Setup a notification based on a policy action, and then select Terminate.

Utilize the Test rule link from within the rule.

Configure the rule to terminate the process.

Configure the rule to deny operation of the process.

What is a security benefit of VMware Carbon Black Cloud Endpoint Standard?

Events and alerts are tagged with Carbon Black TTPs to provide context around attacks.

Firewall rule configuration are provided in the environment.

Data leakage protection (DLP) is enforced on endpoints or subsets of endpoints.

Customized threat feeds can be combined with other outside threat intelligence sources.

VMware 5V0-93.22 Practice Test 1 - Free Online Exam Prep & Questions

Which permission level is required when a user wants to install a sensor on a Windows endpoint?

Everyone

Administrator

Root

User

Comment (0)

VMware 5V0-93.22 Practice Test 1

Question

VMware 5V0-93.22 Practice Tests

Practice Tests