5V0-91.20 questions and answers

Refer to the exhibit:

Which statement is true in regards to communication between the sensor and server?

What is the meaning, if any, of the event Report write (removable media)?

Review this EDR query:

childproc_name:whoami.exe AND childproc_name:hostname.exe AND childproc_name:tasklist.exe AND
childproc_name:ipconfig.exe

Which process would show in the query results?

An administrator ran the following query.

SELECT name, VERSION, install_location, install_source, publisher, install_date, uninstall_string FROM
programs WHERE publisher = "Microsoft Corporation";

The administrator notices a lot of installed programs are not returned.

How can the administrator alter the query to see all results?

How can an analyst disregard alerts on multiple devices with the least amount of administrative effort?

An analyst is investigating an alert within Enterprise EDR on the process analysis page.

The process tree can be seen below:

Which statement accurately characterizes this situation?

An administrator has configured a policy to run a standard background scan.

How long does this one-time scan take to complete on endpoints assigned to that policy?

An analyst is investigating an alert within Enterprise EDR. The alert is tied to an unusual process name.
When navigating to the binary details page, for the binary used in the alert, the analyst sees the following:

The analyst wants to find any instances of this process executing regardless of the process name used.

Which two details from the binary can be used to search for the application regardless of the seen name? (Choose two.)

A security policy states to enable Live Response by default across the enterprise. However, the team identified critical systems which should not support Live Response due to risk. The team needs to disable Live Response on selected systems.

From which page can this goal be accomplished?

An administrator is creating a query per policy for Audit and Remediation. The administrator ran several recommended queries already but notices they are unable to run the same recommended query for one of their policies. The run button is grayed out.

Which statement correctly explains why the run button is unavailable?

An analyst is investigating a specific alert in Endpoint Standard. The analyst selects the investigate button from the alert triage page and sees the following:

Which statement accurately characterizes this situation?

An Enterprise EDR administrator sees the process in the graphic on the Investigate page but does not see an alert for this process:

How can the administrator generate an alert for future hits against this watchlist?

When dismissing alerts, when should an administrator select "If alert occurs in the future, automatically dismiss it from all devices"?

Examine the following EDR query:

file_desc:"Windows Command Processor" AND -process_name:cmd.exe

Which process will show in the query results?

When executing a program in App Control, the notification message informs the user that the file is not approved with an option to request approval.

Which Enforcement level is currently enacted?

Which statement should be used when constructing queries in Carbon Black Audit and Remediation, Live Query?

A watchlist generates a false positive on the Triage Alerts page, so the watchlist must be updated.

How should this task be accomplished?

What are the three available methods in VMware Carbon Black App Control by which an endpoint (agent) can be assigned to a specific policy? (Choose three.)