VMware 5V0-91.20 問題集

質問 1：
An Enterprise EDR administrator wants to use Watchlists curated by VMware Carbon Black and other threat intelligence specialists.
How should the administrator add these curated Watchlists from the Watchlists page?
A. Click Add Watchlists, on the Subscribe tab select the desired Watchlists, and click Subscribe.
B. Click Take Action, select Edit, and select the desired Watchlists.
C. Click Take Action, and select Subscribe for the desired Watchlists.
D. Click Add Watchlists, and input the URL(s) for the desired Watchlists.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 2：
An incorrectly constructed watchlist generates 10,000 incorrect alerts.
How should an administrator resolve this issue?
A. From the Watchlists Page, select the offending watchlist, click "Clear Alerts" from the Action menu, and then update the watchlist with the correct criteria.
B. Update the Triage Alerts Page to show 200 alerts, click the Select All Checkbox, click the "Dismiss Alert(s)" button for each page, and then update the watchlist with the correct criteria.
C. From the Triage Alerts Page, use the facets to select the watchlist, click the Wrench button to "Mark all as Resolved False Positive", and then update the watchlist with the correct criteria.
D. Delete the watchlist to automatically clear the alerts, and then create a new watchlist with the correct criteria.
正解：C

質問 3：
The security operations group is complaining that they are getting multiple App Control alerts for specific malicious files after they have banned the file.
Which step is necessary to prevent future alerts on these files?
A. Edit the Malicious File Detected Alert. Select the criteria: Ignore already banned files.
B. Edit the Malicious File Detected Alert. Select the criteria: Ignore already banned files and Ignore already approved files.
C. Disable the Reminder Mail.
D. Set the Alert Status to Disabled.
正解：C

質問 4：
This search is entered into the process search page: notepad.exe
Which three statements about this query are true? (Choose three.)
A. Processes with registry modifications containing notepad.exe would be retuned.
B. A field identifier is required for all criteria within a process search.
C. All processes containing the text notepad.exe in any default field.
D. Only processes named notepad.exe will be returned.
E. Since a field name is not selected, query performance will be impacted.
F. The search will fail with an error.
正解：A,C,E

質問 5：
An Endpoint Standard administrator finds a binary in the environment and decides to manually add the file hash to the Banned List.
Which reputation does the file now have?
A. Known Malware
B. Company Black
C. Adware/PUP Malware
D. Suspect/Heuristic Malware
正解：D

質問 6：
Carbon Black App Control maintains an inventory of all interesting (executable) files on endpoints where the agent is installed.
What is the initial inventory procedure called, and how can this process be triggered?
A. Initialization; move agent out of Disabled mode
B. Baselining; install the agent
C. Inventorying; enable Discovery mode
D. Discovery; place agent into Disabled mode
正解：C

質問 7：
When dismissing alerts, when should an administrator select "If alert occurs in the future, automatically dismiss it from all devices"?
A. When the administrator wishes to remove the alert
B. When the administrator wishes to apply this action to all future alerts from the device
C. When the administrator wishes to be notified again to this behavior
D. When the administrator wishes to mark the alert instance as a false positive
正解：B

質問 8：
An analyst has investigated two alerts on two separate HR workstations and found that notepad.exe has established communication to another IP address.
Which rule will kill notepad.exe entirely if this activity is detected in the future?
A. **/system32/notepad.exe--> Communicates over the network --> Deny operation
B. **\system32\notepad.exe --> Communicates over the network --> Terminate process
C. **/system32/notepad.exe --> Runs or is Running --> Terminate process
D. **\system32\notepad.exe --> Runs or is Running --> Deny operation
正解：C