VMware 5V0-91.20 Online Practice Questions and Exam Preparation

VMware 5V0-91.20 Online Questions & Answers

• Question 1:

  Why would a sensor have a status of "Inactive"?

  A. The sensor has not checked in within the last 30 days.
  B. The sensor has been uninstalled from the endpoint for more than 30 days.
  C. The device has been put in bypass for the last 30 days.
  D. The sensor has been in disabled mode for more than 30 days.
  A. The sensor has not checked in within the last 30 days.

• Question 2:

  Which list below captures all Enforcement Levels for App Control policies?

  A. Critical, Lockdown, Monitored, Tracking, Banning
  B. High Enforcement, Medium Enforcement, Low Enforcement
  C. High Enforcement, Medium Enforcement, Low Enforcement, None (Visibility), None (Disabled)
  D. Control, Local Approval, Disabled
  C. High Enforcement, Medium Enforcement, Low Enforcement, None (Visibility), None (Disabled)

• Question 3:

  Given the following query:

  SELECT * FROM users WHERE UID >= 500;

  Which statement is correct?

  A. This query limits the number of columns to display in the results.
  B. This query filters results sent to the cloud.
  C. This query is missing a parameter for validity.
  D. This query returns all accounts found on systems.
  A. This query limits the number of columns to display in the results.

• Question 4:

  An administrator is interested in upgrading endpoints to the latest release in VMware Carbon Black App Control (V8.1.4+). What is the first step to make a new agent available for installation or upgrade?

  A. Download from the Carbon Black Cloud Back End
  B. Download from the Carbon Black App Control Server
  C. Download from the Carbon Black User Exchange
  D. Download from the Carbon Black Software Reputation Service (SRS)
  A. Download from the Carbon Black Cloud Back End

• Question 5:

  An administrator viewed and filtered the results of a completed query within the User Interface for Audit and Remediation. The administrator exported the results to create charts and other visuals for reporting. When viewing the exported results, the administrator noticed some results were missing from the data set.

  Why did the administrator not have the full data set from the query?

  A. Export applies to the data visible in the UI; filtering will impact the viewable data.
  B. Export pulls all results; the query must not have covered all data required.
  C. Export is limited to the first hundred rows, and the query had more rows than supported.
  D. Export was used prior to the query completing, and some data is missing.
  D. Export was used prior to the query completing, and some data is missing.

• Question 6:

  A company uses Audit and Remediation to check configurations and adhere to compliance regulations. The regulations require monthly reporting and twelve months of data retained. How can an administrator accomplish this requirement with Audit and Remediation?

  A. Schedule the query to run monthly, and set the data retention to 12 months for the query.
  B. Schedule the query to run monthly, and configure the audit log retention to 12 months.
  C. Schedule the query to run monthly, and no further action is required.
  D. Schedule the query to run monthly, and export the results for each run to an external location.
  D. Schedule the query to run monthly, and export the results for each run to an external location.

• Question 7:

  Review the following EDR query:

  parent_name:outlook.exe AND -alliance_score_srstrust:* AND -digsig_result: "Signed'

  Which process would show in the query results?

  A. Processes invoked by outlook.exe that have an SRS Trust value and that are digitally signed.
  B. Processes invoking outlook.exe that do not have an SRS Trust value and that are not digitally signed.
  C. Processes invoked by outlook.exe that do not have an SRS Trust value and that are not digitally signed.
  D. Processes invoking outlook.exe that have an SRS Trust value and that are not digitally signed.
  D. Processes invoking outlook.exe that have an SRS Trust value and that are not digitally signed.

• Question 8:

  When dismissing alerts, when should an administrator select "If alert occurs in the future, automatically dismiss it from all devices"?

  A. When the administrator wishes to mark the alert instance as a false positive
  B. When the administrator wishes to be notified again to this behavior
  C. When the administrator wishes to apply this action to all future alerts from the device
  D. When the administrator wishes to remove the alert
  C. When the administrator wishes to apply this action to all future alerts from the device

• Question 9:

  A Carbon Black Cloud Endpoint Standard analyst is testing different search operator combinations. Which two queries produce the same result? (Choose two.)

  A. process_name:chrome.exe OR NOT netconn_domain:google.com
  B. process_name:chrome.exe OR netconn_domain:google.com
  C. process_name:chrome.exe AND NOT netconn_domain:google.com
  D. process_name:chrome.exe netconn_domain:google.com
  E. process_narne:chrome.exe NOT netconn_domain:google.com
  A. process_name:chrome.exe OR NOT netconn_domain:google.com
  E. process_narne:chrome.exe NOT netconn_domain:google.com

• Question 10:

  Which statement correctly defines the results of ignoring a feed report?

  A. Ignoring a feed report will ignore future instances of that report.
  B. Ignoring a feed report will ignore all indicators in other threat reports.
  C. Ignoring a feed report will also ignore the threat intelligence feed.
  D. Ignoring a feed report will remove all instances of the report.
  C. Ignoring a feed report will also ignore the threat intelligence feed.