Get New 2024 VMware exam 5V0-93.22 Dumps Bundle On flat Updated Dumps!
Full 5V0-93.22 Practice Test and 62 unique questions with explanations waiting just for you, get it now!
NEW QUESTION # 10
A VMware Carbon Black managed endpoint is showing up as an inactive device in the console.
What is the threshold, in days, before a machine shows as inactive?
- A. 7 days
- B. 60 days
- C. 90 days
- D. 30 days
Answer: A
Explanation:
Explanation
According to the VMware Carbon Black Cloud Endpoint Standard User Guide, the threshold, in days, before a machine shows as inactive in the console is 7 days. An inactive device is a device that has not communicated with the Carbon Black Cloud console for more than 7 days. The console displays the last communication time for each device on the Endpoints page. The administrator can use the Inactive Devices filter to view all the inactive devices in the organization. The administrator can also use the Device Status widget on the Dashboard page to see the number and percentage of inactive devices in the organization. The administrator can take various actions to resolve the inactive device issue, such as:
Check the network connectivity and firewall settings of the device
Check the sensor status and version on the device
Check the policy settings and rules applied to the device
Reinstall the sensor on the device
Delete the device from the console if it is no longer in use References:
VMware Carbon Black Cloud Endpoint Standard User Guide, page 14, Inactive Devices section.
NEW QUESTION # 11
An administrator needs to make sure all files are scanned locally upon execution.
Which setting is necessary to complete this task?
- A. Signature Update frequency must be set to 2 hours.
- B. Run Background Scan must be set to Expedited.
- C. On-Access File Scan Mode must be set to Aggressive.
- D. Allow Signature Updates must be enabled.
Answer: C
NEW QUESTION # 12
An administrator would like to proactively know that something may get blocked when putting a policy rule in the environment.
How can this information be obtained?
- A. Put the rules in and see what happens to the endpoints.
D Determine what would happen based on previously used antivirus software - B. Search the data using the test rule functionality.
B Examine log files to see what would be impacted
Answer: B
NEW QUESTION # 13
An administrator has configured a terminate rule to prevent an application from running. The administrator wants to confirm that the new rule would have prevented a previous execution that had been observed.
Which feature should the administrator leverage for this purpose?
- A. Utilize the Test rule link from within the rule.
- B. Configure the rule to terminate the process.
- C. Configure the rule to deny operation of the process.
- D. Setup a notification based on a policy action, and then select Terminate.
Answer: A
NEW QUESTION # 14
Which statement accurately characterizes Alerts that are categorized as a "Threat" versus those categorized as
"Observed"?
- A. "Threat" indicates a more likely malicious event. "Observed" are less likely to be malicious.
- B. "Threat" indicates that no block (Deny or Terminate) has occurred. "Observed" indicates a block.
- C. "Threat" indicates a block (Deny or Terminate) has occurred. "Observed" indicates that there is no block.
- D. "Threat" indicates an ongoing attack. "Observed" indicates the attack is over and is being watched.
Answer: A
NEW QUESTION # 15
What is a security benefit of VMware Carbon Black Cloud Endpoint Standard?
- A. Events and alerts are tagged with Carbon Black TTPs to provide context around attacks.
- B. Customized threat feeds can be combined with other outside threat intelligence sources.
- C. Firewall rule configuration are provided in the environment.
- D. Data leakage protection (DLP) is enforced on endpoints or subsets of endpoints.
Answer: A
Explanation:
Explanation
VMware Carbon Black Cloud Endpoint Standard is a next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution that protects against the full spectrum of modern cyber-attacks. It uses the VMware Carbon Black Cloud's universal agent and console, the solution applies behavioral analytics to endpoint events to streamline detection, prevention, and response to cyber-attacks. One of the security benefits of Endpoint Standard is that it tags events and alerts with Carbon Black TTPs (tactics, techniques, and procedures) to provide context around attacks. Carbon Black TTPs are based on the MITRE ATT&CK framework, which is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. By tagging events and alerts with Carbon Black TTPs, Endpoint Standard helps security teams to understand the nature and scope of the attack, prioritize the most critical threats, and take appropriate actions to remediate them. References: Carbon Black Cloud Endpoint Standard - Technical Overview, VMware Carbon Black Cloud Endpoint Standard Datasheet, MITRE ATT&CK
NEW QUESTION # 16
An administrator is investigating an alert and reads a summary that says:
The application powershell.exe was leveraged to make a potentially malicious network connection.
Which action should the administrator take immediately to block that connection?
- A. Click Delete Application
- B. Click Drop Connection
- C. Click Quarantine Asset
- D. Click Export Alert
Answer: B
Explanation:
Explanation
The correct answer is to click Drop Connection, which is a feature of VMware Carbon Black Cloud Endpoint Standard that allows the administrator to immediately terminate a network connection that is deemed malicious or suspicious. This feature can be accessed from the Alert Details page, where the administrator can see the application, process, and destination IP address of the connection. By clicking Drop Connection, the administrator can block the connection without affecting the rest of the system or network. This is a quick and effective way to stop a potential threat from communicating with a remote server or exfiltrating data. References: = VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 4.3:
Investigate Alerts, Subsection 4.3.2: Drop Connection.
NEW QUESTION # 17
Which VMware Carbon Black Cloud process is responsible for uploading event reporting to VMware Carbon Black Cloud?
- A. Scanner Service (scanhost)
- B. Sensor Service (RepUx
- C. Scanner Service (Re
- D. Sensor Service (RepMqr
Answer: D
Explanation:
Explanation
According to the VMware Carbon Black Cloud Endpoint Standard User Guide, the Sensor Service (RepMqr) is the process that is responsible for uploading event reporting to VMware Carbon Black Cloud. The Sensor Service (RepMqr) is one of the components of the VMware Carbon Black Cloud sensor, which is the software agent that runs on the endpoints and collects and sends data to the VMware Carbon Black Cloud console. The Sensor Service (RepMqr) is responsible for the following tasks:
Collecting and compressing endpoint events
Sending endpoint events to the VMware Carbon Black Cloud console
Receiving and applying policy updates from the VMware Carbon Black Cloud console Performing actions requested by the VMware Carbon Black Cloud console, such as quarantine, unquarantine, or bypass The other processes are not responsible for uploading event reporting to VMware Carbon Black Cloud. The Sensor Service (RepUx) is the process that is responsible for uploading file metadata and content to VMware Carbon Black Cloud. The Scanner Service (scanhost) is the process that is responsible for scanning the endpoint for malicious files and activity. The Scanner Service (Re) is the process that is responsible for scanning the endpoint for reputation information. References:
VMware Carbon Black Cloud Endpoint Standard User Guide, page 7, Sensor Components section, Sensor Service (RepMqr) subsection.
NEW QUESTION # 18
A security administrator notices an unusual software behavior on an endpoint. The administrator immediately used the search query to collect data and start analyzing indicators to find the solution.
What is a pre-requisite step in gathering specific vulnerability data to export it as a CSV file for analysis?
- A. Enable cloud analysis.
- B. Search for specific malware byhash or filename.
- C. Access the Audit Log content to see associated events.
- D. Perform a custom search on the Endpoint Page.
Answer: D
NEW QUESTION # 19
An administrator has dismissed a group of alerts and ticked the box for "Dismiss future instances of this alert on all devices in all policies". There is also a Notification configured to email the administrator whenever an alert of the same Severity occurs. The following day, a new alert is added to the same group of alerts.
How will this alert be handled?
- A. The alert will show when the Not Dismissed filter is selected on Alerts page, and a Notification email will be sent.
- B. The alert will show when the Dismissed filter is selected on the Alerts page, and a Notification email will be sent.
- C. The alert will show when the Dismissed filter is selected on Alerts page, but a Notification email will not be sent.
- D. The alert will show when Not Dismissed filter is selected on Alerts page, but a Notification email will not be sent.
Answer: C
NEW QUESTION # 20
The administrator has configured a permission rule with the following options selected:
Application at path: C:\Program Files\**
Operation Attempt: Performs any operation
Action: Bypass
What is the impact, if any, of using the wildcards in the application at path field?
- A. Executable files in the "Program Files" directory will be blocked.
- B. Executable files in the "Program Files" directory will be logged.
- C. Executable files in the "Program Files" directory will be subject to blocking rules.
- D. Executable files in the "Program Files" directory and subdirectories will be ignored.
Answer: D
Explanation:
Explanation
The impact of using the wildcards in the application at path field is that executable files in the "Program Files" directory and subdirectories will be ignored by the VMware Carbon Black Cloud Endpoint Standard sensor.
This is because the permission rule has the following options selected:
Application at path: C:\Program Files**
Operation Attempt: Performs any operation
Action: Bypass
The application at path field specifies the path of the executable file that the rule applies to. The ** wildcard matches a partial path across all subdirectory levels and is recursive. For example, C:\Program Files** matches any files in that directory and all subdirectories1.
The operation attempt field specifies the type of operation that the executable file attempts to perform. The Performs any operation option means that the rule applies to any operation, such as creating a file, modifying a registry key, or executing a command.
The action field specifies the action that the VMware Carbon Black Cloud Endpoint Standard sensor takes when the rule is triggered. The Bypass option means that the sensor ignores the executable file and does not apply any blocking rules or log any events for it2.
Therefore, by using the wildcards in the application at path field, the permission rule effectively excludes any executable files in the "Program Files" directory and subdirectories from the VMware Carbon Black Cloud Endpoint Standard sensor's prevention and detection capabilities. References:
Prevention Policy Settings - VMware Docs, Permissions section, Action subsection.
Set Permission Policy Rules - VMware Docs, Procedure section, step 4.
Carbon Black Cloud: How to Use Wildcards in Policy Rules - Carbon Black Community, Wildcard Description table, ** row.
NEW QUESTION # 21
An administrator has been tasked with preventing the use of unauthorized USB storage devices from being used in the environment.
Which item needs to be enabled in order to enforce this requirement?
- A. Enable the Block access to all unapproved USB devices within the policies option.
- B. Select the option to block USB devices from the Reputation page.
- C. Elect to approve only allowed USB devices from the USB Devices page.
- D. Choose to disable USB device access on each endpoint from the Inventory page.
Answer: C
Explanation:
Explanation
To prevent the use of unauthorized USB storage devices, the administrator needs to enable the USB Device Control feature in the VMware Carbon Black Cloud Endpoint Standard. This feature allows the administrator to approve or block specific USB devices based on their vendor ID, product ID, serial number, and device type. The administrator can also set a default action for unapproved USB devices, such as block, read-only, or allow. The administrator can manage the USB devices from the USB Devices page under the Settings menu. From this page, the administrator can view the list of USB devices that have been detected by the endpoints, and elect to approve only the allowed USB devices. The administrator can also export or import the list of approved USB devices for backup or replication purposes. References:
VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Module 4: USB Device Control, pages 4-1 to 4-9.
VMware Carbon Black Cloud Endpoint Standard User Guide, Chapter 11: USB Device Control, pages
147-152.
NEW QUESTION # 22
An organization is seeing a new malicious process that has not been seen before.
Which tool can be used to block this process?
- A. Malware Removal
- B. Certificate banned list
- C. Live Response
- D. Policy rules
Answer: C
Explanation:
Explanation
Live Response is a tool that allows administrators to remotely access and remediate endpoints in real time.
With Live Response, administrators can block a new malicious process by killing it, deleting its files, and removing any persistence mechanisms. Live Response can also be used to collect forensic data, run scripts, and perform other actions on the endpoints. References: VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 5.3: Live Response. [Link]
NEW QUESTION # 23
Which port does the VMware Carbon Black sensor use to communicate to VMware Carbon Black Cloud?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
Explanation:
Explanation
The VMware Carbon Black sensor uses port 443 by default to communicate with the VMware Carbon Black Cloud. This port is used for both incoming and outgoing TCP connections to the environment-specific URLs that provide console access, API requests, sensor communication, UBS download, signature update, third-party certificate validation, and Live Response uploads. Port 54443 is used as a backup port in case port
443 is blocked or unavailable. Ports 80 and 22 are not used by the VMware Carbon Black sensor. References: Configure a Firewall, Ports and URLs
NEW QUESTION # 24
An administrator needs to find all events on the Investigate page where the process is svchost.exe, and the path is not the standard path of C:\Windows\System32.
Which advanced search will yield these results?
- A. process_name:svchost.exe AND NOT process_name:C\:\\Windows\\System32
- B. process_name:svchost.exe EXCLUDE process_name:C:\Windows\System32
- C. process_name:svchost.exe EXCLUDE process_name:C\:\\Windows\\System32
- D. process_name:svchost.exe AND NOT process_name:C:\Windows\System32
Answer: A
NEW QUESTION # 25
What are the highest and lowest file reputation priorities, respectively, in VMware Carbon Black Cloud?
- A. Priority 1: Known Malware, Priority 11: Common White
- B. Priority 1: Unknown, Priority 11: Ignore
- C. Priority 1: Ignore, Priority 11: Unknown
- D. Priority 1: Company Allowed, Priority 11: Not Listed/Adaptive White
Answer: C
Explanation:
Explanation
According to the VMware Carbon Black Cloud User Guide, the reputation priority is in a descending order with 1 being the highest priority and 11 the lowest priority. The highest priority reputation is Ignore, which is a self-check reputation that Carbon Black Cloud assigns to product files and grants them with full permissions to run. The lowest priority reputation is Unknown, which indicates that Carbon Black Cloud has not yet determined the reputation of the file. References:
Reputation Assignment - VMware Docs, Reputation Priority table.
NEW QUESTION # 26
An organization has the following requirements for allowing application.exe:
Must not work for any user's D:\ drive
Must allow running only from inside of the user's Temp\Allowed directory Must not allow running from anywhere outside of Temp\Allowed For example, on one user's machine, the path is C:\Users\Lorie\Temp\Allowed\application.exe.
Which path meets this criteria using wildcards?
- A. *:\Users\*\Temp\Allowed\application.exe
- B. *:\Users\**\Temp\Allowed\application.exe
- C. C:\Users\*\Temp\Allowed\application.exe
- D. C:\Users\?\Temp\Allowed\application.exe
Answer: C
NEW QUESTION # 27
A security administrator is tasked to enable Live Response on all endpoints in a specific policy.
What is the correct path to configure the required sensor policy setting?
- A. Enforce > Policy > Policies > Sensor
- B. Policies > Enforce > Policy > Sensor
- C. Policies > Policy > Sensor > Enforce
- D. Enforce > Policies > Policy > Sensor
Answer: A
NEW QUESTION # 28
An administrator wants to be notified when particular Tactics, Techniques, or Procedures (TTPs) are observed on a managed endpoint.
Which notification option must the administrator configure to receive this notification?
- A. Alert that crosses a threshold with the "observed" option selected
- B. Alert for a Watchlist hit
- C. Alert that includes specific TTPs
- D. Policy action that is enforced with the "deny" opt ion selected
Answer: B
Explanation:
Explanation
A Watchlist is a collection of queries that run against the data in the VMware Carbon Black Cloud Endpoint Standard. Watchlists enable administrators to monitor the activity of endpoints for specific Tactics, Techniques, or Procedures (TTPs) that are of interest. Administrators can configure alerts for Watchlist hits, which will notify them when a particular TTP is observed on a managed endpoint. Alerts for Watchlist hits can be sent via email, syslog, or webhook. References:
VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Module 3: Threat Hunting, Lesson 3.2: Watchlists, page 3-10 VMware Carbon Black Cloud Endpoint Standard User Guide, Chapter 7: Watchlists, page 115-116
NEW QUESTION # 29
An administrator is working in a development environment that has a policy rule applied and notices that there are too many blocks. The administrator takes action on the policy rule to troubleshoot the issue until the blocks are fixed.
Which action should the administrator take?
- A. Unenforce
- B. Recall
- C. Disable
- D. Delete
Answer: C
NEW QUESTION # 30
An administrator needs to configure a policy for macOS and Linux Sensors, not enabling settings which are only applicable to Windows.
Which three settings are only applicable to Sensors on the Windows operating system? (Choose three.)
- A. Delay execute for cloud scan
- B. Require code to uninstall sensor
- C. Submit unknown binaries for analysis
- D. Expedited background scan
- E. Allow user to disable protection
- F. Scan execute on network drives
Answer: A,B,F
NEW QUESTION # 31
A security administrator is tasked to enable Live Response on all endpoints in a specific policy.
What is the correct path to configure the required sensor policy setting?
- A. Enforce > Policies > Policy > Sensor
- B. Policies > Enforce > Policy > Sensor
- C. Enforce > Policy > Policies > Sensor
- D. Policies > Policy > Sensor > Enforce
Answer: A
Explanation:
Explanation
To enable Live Response on all endpoints in a specific policy, the security administrator needs to follow the correct path to configure the required sensor policy setting. The correct path is Enforce > Policies > Policy > Sensor. This path allows the administrator to select a policy group, then click on the Sensor tab, where they can select or deselect the Enable Live Response checkbox as applicable, and then click Save. This will enable or disable Live Response for all endpoints that are assigned to that policy group. The other options are incorrect because they do not match the correctpath to configure the sensor policy setting for Live Response. References: Use Live Response, Use Live Response for VM Workloads
NEW QUESTION # 32
Which statement is true regarding Blocking/Isolation rules and Permission rules?
- A. Blocking & Isolation rules are overridden by Upload Rules.
- B. Upload Rules are overridden by Blocking & Isolation rules.
- C. D.Blocking & Isolation rules are overridden by Permission Rules
- D. Permission Rules are overridden by Blocking & Isolation rules
Answer: C
Explanation:
Explanation
The correct statement regarding Blocking/Isolation rules and Permission rules is D. Blocking & Isolation rules are overridden by Permission Rules. This means that if a file or process matches both a Blocking/Isolation rule and a Permission rule, the action specified by the Permission rule will take precedence over the action specified by the Blocking/Isolation rule. For example, if a file has a reputation of SUSPECT_MALWARE and a Blocking/Isolation rule is set to terminate any SUSPECT_MALWARE file that runs, but a Permission rule is set to allow and log any file that runs from a specific path, the file will be allowed and logged if it runs from that path, regardless of its reputation. Permission rules are useful for tuning the behavior of VMware Carbon Black Cloud Endpoint Standard and preventing false positives or unnecessary blocks1.
The other statements are false or irrelevant. Blocking & Isolation rules are not overridden by Upload Rules.
Upload Rules are rules that specify which files and metadata are uploaded to the Carbon Black Cloud for analysis and reputation. Upload Rules do not affect the prevention or detection capabilities of VMware Carbon Black Cloud Endpoint Standard2. Permission Rules are not overridden by Blocking & Isolation rules. As explained above, Permission Rules have a higher priority than Blocking & Isolation rules and can override their actions. Upload Rules are not overridden by Blocking & Isolation rules. Upload Rules and Blocking & Isolation rules are independent of each other and do not affect each other's functionality. References:
Prevention Policy Settings - VMware Docs, Permissions section, Action subsection.
Upload Rules - VMware Docs, Overview section.
NEW QUESTION # 33
An administrator has been tasked with preventing the use of unauthorized USB storage devices from being used in the environment.
Which item needs to be enabled in order to enforce this requirement?
- A. Enable the Block access to all unapproved USB devices within the policies option.
- B. Select the option to block USB devices from the Reputation page.
- C. Elect to approve only allowed USB devices from the USB Devices page.
- D. Choose to disable USB device access on each endpoint from the Inventory page.
Answer: A
NEW QUESTION # 34
......
Reduce Your Chance of Failure in 5V0-93.22 Exam: https://examdumps.passcollection.com/5V0-93.22-valid-vce-dumps.html
