QUESTION: 37

An Enterprise EDR administrator sees the process in the graphic on the Investigate page but does not see an alert for this process:
How can the administrator generate an alert for future hits against this watchlist?

select the watchlist on the watchlists page, select the Scheduled Task Created report, and use Take Action to select Alert on hit for the report.
Select the watchlist on the watchlists page, select the Scheduled Task Created report, and use Take Action to toggle Alert on hit to On.
Select the watchlist on the watchlists page and click on Alerts: Off to toggle the alerts to On.
Select the watchlist on the watchlists page, use Take Action to select Edit, and select Alert on hit.

Answer(s): D

Reveal Solution Next Question

QUESTION: 38

What are the three available methods in VMware Carbon Black App Control by which an endpoint (agent) can be assigned to a specific policy? (Choose three.)

By pushing the designated GPO script
Via DASCLI command
By installing the agent via SCCM
Manual policy assignment
By branded/policy-specific installer
By Active Directory Mapping

Answer(s): C,D,F

Reveal Solution Next Question

QUESTION: 39

Review the following EDR query:
parent_name:outlook.exe AND -alliance_score_srstrust:* AND -digsig_result: "Signed' Which process would show in the query results?

Processes invoked by outlook.exe that have an SRS Trust value and that are digitally signed.
Processes invoking outlook.exe that do not have an SRS Trust value and that are not digitally signed.
Processes invoked by outlook.exe that do not have an SRS Trust value and that are not digitally signed.
Processes invoking outlook.exe that have an SRS Trust value and that are not digitally signed.

Answer(s): D

Reveal Solution Next Question

QUESTION: 40

Review the following EDR query:
(parent_name:powershell.exe OR parent_name:cmd.exe) AND netconn_count:[l TO *] Which process would show in the query results?

Processes invoked by Powershell.exe and cmd.exe with a single network connection event
Processes invoking Powershell.exe and cmd.exe with multiple network connection events
Processes invoked by Powershell.exe or cmd.exe with any number of network connection events
Processes invoking Powershell.exe or cmd.exe with multiple network connection events

Answer(s): A

Reveal Solution Next Question

Free 5V0-91.20 Exam Braindumps (page: 10)

QUESTION: 37

QUESTION: 38

QUESTION: 39

QUESTION: 40