A company wants to prevent an executable from running in their organization. The current reputation for the file is NOT LISTED, and the machines are in the default standard policy.Which action should be taken to prevent the file from executing?

Add the hash to the company banned list.

Add the hash to the MALWARE list.

Use Live Response to kill the process.

Use Live Response to delete the file.

Add the hash to the company banned list.

An organization is implementing policy rules. The administrator mentions that one operation attempt must use a Terminate Process action.Which operation attempt has this requirement?

Performs ransom ware-like behavior

Scrapes memory of another process

An administrator needs to find all events on the Investigate page where the process is svchost.exe, and the path is not the standard path of C:\Windows\System32.Which advanced search will yield these results?

process_name:svchost.exe AND NOT process_name:C\:\\Windows\\System32

process_name:svchost.exe EXCLUDE process_name:C\:\\Windows\\System32

process_name:svchost.exe AND NOT process_name:C:\Windows\System32

process_name:svchost.exe AND NOT process_name:C\:\\Windows\\System32

process_name:svchost.exe EXCLUDE process_name:C:\Windows\System32

An administrator has dismissed a group of alerts and ticked the box for 'Dismiss future instances of this alert on all devices in all policies'. There is also a Notification configured to email the administrator whenever an alert of the same Severity occurs. The following day, a new alert is added to the same group of alerts.How will this alert be handled?

The alert will show when the Dismissed filter is selected on Alerts page, but a Notification email will not be sent.

The alert will show when the Dismissed filter is selected on the Alerts page, and a Notification email will be sent.

The alert will show when the Dismissed filter is selected on Alerts page, but a Notification email will not be sent.

The alert will show when the Not Dismissed filter is selected on Alerts page, and a Notification email will be sent.

The alert will show when Not Dismissed filter is selected on Alerts page, but a Notification email will not be sent.

An administrator wants to prevent ransomware that has not been seen before, without blocking other processes.Which rule should be used?

[Not listed application] [Performs ransomware-like behavior] [Terminate process

[Adware or PUP] [Scrapes memory of another process] [Deny operation]

[Not listed application] [Performs ransomware-like behavior] [Terminate process

[Unknown malware] [Runs or is running] [Terminate process]

[Not listed application] [Runs or is running] [Terminate process]

Which scenario would qualify for the 'Local White' Reputation?

The file was added as an IT took

The file was signed using a trusted certificate.

The hash was not on any known good or known bad lists, AND the file is signed.

The hash was previously analyzed, AND it is not on any known good or bad lists.

An administrator needs to make sure all files are scanned locally upon execution.Which setting is necessary to complete this task?

On-Access File Scan Mode must be set to Aggressive.

Signature Update frequency must be set to 2 hours.

Allow Signature Updates must be enabled.

Run Background Scan must be set to Expedited.

An organization has found application.exe running on some machines in their Workstations policy. Application.exe has a SUSPECT_MALWARE reputation and runs from C:\Program Files\IT\Tools. The Workstations policy has the following rules which could apply:Blocking and Isolation RulePermissions RuleWhich action, if any, should an administrator take to ensure application.exe cannot run?

Remove the Permissions rule for C:\Program FilesMTVToolsV.

Change the reputation to KNOWN MALWARE to a higher priority.

No action needs to be taken as the file will be blocked based on reputation alone.

Remove the Permissions rule for C:\Program FilesMTVToolsV.

Add the hash to the company banned list at a higher priority.

An administrator has configured a permission rule with the following options selected:Application at path: C:\Program Files\**Operation Attempt: Performs any operationAction: BypassWhat is the impact, if any, of using the wildcards in the path?

All executable files in the 'Program Files' folder and subfolders will be ignored, including malware files.

No Files will be ignored from the 'Program Files' director/, but Malware in the 'Program Files' directory will continue to be blocked.

Executable files in the 'Program Files' folder will be blocked.

Only executable files in the 'Program Files' folder will be ignored, including malware files.

What is a security benefit of VMware Carbon Black Cloud Endpoint Standard?

Visibility into the entire attack chain and customizable threat intelligence that can be used to gain insight into problems

A flexible query scheduler that can be used to gather information about the environment

Visibility into the entire attack chain and customizable threat intelligence that can be used to gain insight into problems

Customizable threat feeds that plug into a single agent and single console

Policy rules that can be tested by selecting test rule next to the desired operation attempt

An administrator notices that a sensor's local AV signatures are out-of-date.What effect does this have on newly discovered files?

The reputation is determined by cloud reputation.

The sensor prompts the end user to allow or deny the file.

The sensor automatically blocks the new file.

The sensor is unable to block a malicious file.

An administrator wants to block ransomware in the organization based on leadership's growing concern about ransomware attacks in their industry.What is the most effective way to meet this goal?

Turn on the performs ransomware-like behavior rule in the policies.

Look at current attacks to see if the software that is running is vulnerable to potential ransomware attacks.

Turn on the performs ransomware-like behavior rule in the policies.

Recognize that analytics will automatically block the attacks that may occur.

Start in the monitored policy until it is clear that no attacks are happening.

A security administrator is tasked to enable Live Response on all endpoints in a specific policy.What is the correct path to configure the required sensor policy setting?

Enforce > Policy > Policies > Sensor

Policies > Policy > Sensor > Enforce

Policies > Enforce > Policy > Sensor

Enforce > Policies > Policy > Sensor

VMware 5V0-93.22 Practice Test 2 - Free Online Exam Prep & Questions

An administrator needs to fully analyze the relevant information of an event stored in the VMware Carbon Black Cloud.

On which page can this information be found?

Become a Premium Member for full access

Unlock Premium Member

VMware 5V0-93.22 Practice Test 2

Question

VMware 5V0-93.22 Practice Tests

Practice Tests