5V0-91.20: VMware Carbon Black Portfolio Skills

An administrator is troubleshooting App Control agent issues. When navigating to the Computer Details page, the administrator sees the following:

What is the status of the WINDOWS-CLIENT agent?

Connected and Up to date
Disconnected and Up to date
Connected but unsupported
Connected but health check failed

Correct answer: B

There is a need to ignore all activity at an application path. Which rule definition should be used to address this need?

Application at Path, Performs any operation, Bypass
Application at Path, Runs or is Running, Bypass
Application at Path, Runs or is Running, Allow & Log
Application at Path, Performs any operation, Allow & Log

Correct answer: A

Explanation:

Reference: https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-Console-How-to-Set-up-Exclusions-in-the/ta-p/42334

An analyst is investigating an alert within the Enterprise EDR console and needs to take action on it.

Which three actions are available to take on the alert? (Choose three.)

Ignore alert
Dismiss
Dismiss on all devices if grouping is enabled
Edit watchlist
Save report
Notifications history

Correct answer: BCE

Explanation:

Reference: https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Dismiss-Alerts/ta-p/51766

An administrator needs to manage a group of sensors from within the console.

Which three actions are available for sensors within the Sensor Group? (Choose three.)

Move to group
Disable
Restart
Ban
Uninstall
Share Settings

Correct answer: ACE

Explanation:

Reference: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwjttoeA3ILvAhU6QhUIHZaND-YQFjAAegQIARAD&url=https%3A%2F%2Fcommunity.carbonblack.com%2Fgbouw27325%2Fattachments%2Fgbouw27325%2Fproduct-docs-news%2F3020%2F1%2FCB_EDR_7.3_User_Guide.pdf&usg=AOvVaw23smt4s66MWHdv9jM2PYF- (86)

An analyst has investigated two alerts on two separate HR workstations and found that notepad.exe has established communication to another IP address.

Which rule will kill notepad.exe entirely if this activity is detected in the future?

**\system32\notepad.exe --> Communicates over the network --> Terminate process
**\system32\notepad.exe --> Runs or is Running --> Deny operation
**/system32/notepad.exe --> Runs or is Running --> Terminate process
**/system32/notepad.exe--> Communicates over the network --> Deny operation

Correct answer: C

Explanation:

Reference: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwj88fL33YLvAhVQRhUIHYbdDxAQFjABegQIARAD&url=https%3A%2F%2Fwww.carbonblack.com%2Fblog%2Fcb-threatsightinvestigation-reveals-retadup-worm-leverages-autoit-launch-monero-cryptomining-campaign%2F&usg=AOvVaw0De3tmD7FlQSs8VNMVsH7u

A Carbon Black administrator received an alert for an untrusted hash executing in the environment.

Which two information items are found in the alert pane? (Choose two.)

Launch Live Query
Launch process analysis
User quarantine
Add hash to banned list
IOC short name

Correct answer: AB

An administrator observes the following event detail in the Investigate tab for an application with an unknown reputation making network connections:

Upon further review of the event details returned, the reputation is observed as NOT_LISTED, and the applied (cloud) reputation is UNKNOWN.

Why is the applied (cloud) reputation UNKNOWN and not NOT_LISTED?

The sensor demoted the local reputation from UNKNOWN to NOT_LISTED based on the coud reputation.
NOT_LISTED was applied by the sensor after observing no cloud reputation, as evidenced by the applied cloud reputation UNKNOWN.
The application was UNKNOWN at the time of the event but then later determined to be NOT_LISTED.
The sensor demoted the local reputation from NOT_LISTED to UNKNOWN based on the cloud reputation.

Correct answer: C

Explanation:

In which two ways can the tamper protection on an App Control agent be disabled when diagnosing agent issues or removing the agent? (Choose two.)

From the Computer Details page on the web console
From the Files on Computers page on the web console
Run authenticated DasCLI on Windows command prompt
Run RepCLI on Windows command prompt
From the File Catalog page on the web console

Correct answer: AC

Explanation:

Reference: https://community.carbonblack.com/t5/Knowledge-Base/App-Control-How-to-Disable-Enable-Tamper-Protection/ta-p/37220

Which Sensor Status under Endpoint Health indicates that a system's policy enforcement is disabled, and the sensor is not sending security event data to the cloud?

Quarantined
Deregistered
Inactive
Bypass

Correct answer: D

Explanation:

Reference: https://community.carbonblack.com/t5/Knowledge-Base/CB-Defense-What-Happens-When-Bypass-has-been-Enabled-on-the/ta-p/74905

An Enterprise EDR administrator has created a custom Watchiist and wants to add a custom query to a report in the custom Watchiist.

From which page can the administrator add this custom query?

Policies
Watchlists
Investigate
Cloud Analysis

Correct answer: C

Explanation:

Reference: https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwih0bWU4oLvAhX-UBUIHVBDDSUQFjAAegQIAhAD&url=https%3A%2F%2Fcommunity.carbonblack.com%2Fgbouw27325%2Fattachments%2Fgbouw27325%2Fproduct-docs-news%2F1913%2F18%2FEnterprise%2520EDR%2520Getting%2520Started.pdf&usg=AOvVaw2_M7opfEgUaIIfutBZChvk