Free 5V0-91.20 Exam braindumps download (5V0-91.20 exam dumps Free)

QUESTION: 46

An active compromise is detected on an endpoint. Due to current policies, the compromise was detected but not terminated.
What would be an appropriate action to end the current communication between the device and the attacker?

Uninstall the sensor
Place the system into bypass mode
Place the system into Quarantine
Remotely scan the endpoint

Answer(s): B

Show Answer Next Question

QUESTION: 47

How is a new Alert of type Event Alert created whenever an endpoint is added or deleted and send emails for the App Control admin whenever these events occur?

Add filter in Event Properties for Subtype Endpoint added and Endpoint deleted. Click Create and add the App Control admin email, and then click Create &. Exit.
Add filter in Event Properties for Subtype Computer added and Computer deleted. Add the App Control admin email, and then click Create & Exit.
Add filter in Event Properties for Subtype Computer added and Computer deleted. Click Create and add the App Control admin email, and then click Create & Exit.
Add filter in Event Properties for Subtype Computer modified. Add the App Control admin email, and then click Create & Exit.

Answer(s): D

Show Answer Next Question

QUESTION: 48

An administrator is reviewing an alert about a known and required application in the environment. The application has been given the reputation of PUP, with the alert reason being that the PUP was detected. As a result, this application is matching policy blocking & isolation rules for PUPs in the environment and Is not behaving as expected.
Which step should the administrator take to remediate this situation?