QUESTION: 45

There is a requirement to block ransomware when a sensor is offline.
Which blocking and isolation rule fulfills this requirement?

Known Malware --> Performs ransomware-like behavior --> Terminate process
Not Listed Application --> Performs ransomware-like behavior --> Deny operation
Suspect Malware --> Performs ransomware-like behavior --> Deny operation
Unknown Application --> Performs ransomware-like behavior --> Terminate process

Answer(s): A

Reveal Solution Next Question

An active compromise is detected on an endpoint. Due to current policies, the compromise was detected but not terminated.
What would be an appropriate action to end the current communication between the device and the attacker?

Uninstall the sensor
Place the system into bypass mode
Place the system into Quarantine
Remotely scan the endpoint

Answer(s): B

Reveal Solution Next Question

QUESTION: 47

How is a new Alert of type Event Alert created whenever an endpoint is added or deleted and send emails for the App Control admin whenever these events occur?

Add filter in Event Properties for Subtype Endpoint added and Endpoint deleted. Click Create and add the App Control admin email, and then click Create &. Exit.
Add filter in Event Properties for Subtype Computer added and Computer deleted. Add the App Control admin email, and then click Create & Exit.
Add filter in Event Properties for Subtype Computer added and Computer deleted. Click Create and add the App Control admin email, and then click Create & Exit.
Add filter in Event Properties for Subtype Computer modified. Add the App Control admin email, and then click Create & Exit.

Answer(s): D

Reveal Solution Next Question

QUESTION: 48

An administrator is reviewing an alert about a known and required application in the environment. The application has been given the reputation of PUP, with the alert reason being that the PUP was detected. As a result, this application is matching policy blocking & isolation rules for PUPs in the environment and Is not behaving as expected.
Which step should the administrator take to remediate this situation?

Add the file to the Approved List and Dismiss alert
Add the file to the Approved List
Dismiss the alert
Add the file to the Banned List and Delete application

Answer(s): C

Reveal Solution Next Question

Free 5V0-91.20 Exam Braindumps (page: 12)

QUESTION: 45

QUESTION: 46

QUESTION: 47

QUESTION: 48