VMware 5V0-91.20 問題集

質問 1：
An analyst is investigating an alert within Enterprise EDR on the process analysis page. The process tree can be seen below:

Which statement accurately characterizes this situation?
A. The analyst navigated to this process analysis page from the wscrlpt.exe process.
B. Several nodes in this process tree have watchlist hits.
C. Conhost.exe has one or more child processes.
D. The solid line between the nodes denotes a process was injected into by another process.
正解：D

質問 2：
Which statement should be used when constructing queries in Carbon Black Audit and Remediation, Live Query?
A. ALTER
B. REMOVE
C. UPDATE
D. SELECT
正解：D

質問 3：
Which value should an administrator use when reviewing an alert to determine the file reputation at the time the event occurred?
A. Cloud Reputation (Current)
B. Cloud Reputation (Initial)
C. Effective Reputation
D. Local Reputation
正解：B

質問 4：
Which statement is true about configuring VMware Carbon Black Application Control for use on non-persistent virtual machines (VM's)?
A. The endpoint housing the agent template must always be off except when updating the image.
B. The endpoint housing the agent template must always be on/running except when updating the image.
C. The agent running on the template machine must not be initialized before deploying clones.
D. The gold image housing the agent template must be digitally signed to ensure the integrity of the agent cache.
正解：C

質問 5：
An analyst is reviewing an alert in Enterprise EDR from a custom watchlist. The analyst disagrees with the alert severity rating.
How can the analyst change the alert severity value, if this is possible?
A. The alert severity is not configurable.
B. The alert severity is assigned by the backend analytics.
C. Change the alert severity on the watchlist.
D. Change the alert severity on the report.
正解：C

質問 6：
A process is writing numerous interesting files that never actually execute.
Which rule type can the administrator define that will prevent reporting these file creations?
A. File Creation Control (Suppress)
B. Performance Optimization
C. Expert (Tag Process, Terminate Process)
D. Execute Ignore
正解：B

質問 7：
What is the maximum number of binaries (hashes) that can be banned using the web console?
A. 300
B. 500
C. 400
D. 600
正解：A

質問 8：
Management has directed that the SOC team be enabled to create global file bans via the App Control API.
How would this be configured in the App Control Console?
A. Add permission "Manage files" and create an API token for each SOC user.
B. Create a Role, map it to the corresponding SOC group, add permission "Manage files" to Role, and create an API token for each user in group.
C. Create a Role, map to the corresponding SOC group, add permission "Manage files", and create API token for the Role.
D. Create a Role, map to corresponding SOC group, and add permission "Manage files" to Role.
正解：C