VMware Carbon Black Cloud Endpoint Standard Skills 5V0-93.22 Exam Dumps

dumps2024-01-08T10:33:12+08:00

Passing the VMware 5V0-93.22 exam is a required test for VMware Carbon Black Cloud Endpoint Standard Skills 2023 certification. VMware certification 5V0-93.22 real exam contains 60 Single and Multiple Choice, proctored questions, and you have 105 minutes to answer all the questions. The passing score for the VMware 5V0-93.22 exam is 300. The available language is English. VMware 5V0-93.23 exam price is $250. We have cracked the latest VMware 5V0-93.22 exam dumps, which are valid in preparation. Free VMware Carbon Black Cloud Endpoint Standard Skills 5V0-93.22 exam dumps are below.

Page 1 of 2

1. An administrator has been tasked with preventing the use of unauthorized USB storage devices from being used in the environment.

Which item needs to be enabled in order to enforce this requirement?

Enable the Block access to all unapproved USB devices within the policies option.

Choose to disable USB device access on each endpoint from the Inventory page.

Select the option to block USB devices from the Reputation page.

Elect to approve only allowed USB devices from the USB Devices page.

2. An administrator needs to create a search, but it must exclude "system.exe".

How should this task be completed?

#process_name:system.exe

*process_name:system.exe

<process_name:system.exe>

-process_name:system.exe

3. An administrator needs to use an ID to search and investigate security incidents in Carbon Black Cloud.

Which three IDs may be used for this purpose? (Choose three.)

Threat

Hash

Sensor

Event

User

Alert

4. Which VMware Carbon Black Cloud integration is supported for SIEM?

SolarWinds

LogRhythm

Splunk App

Datadog

5. What connectivity is required for VMware Carbon Black Cloud Endpoint Standard to perform Sensor Certificate Validation?

TCP/443 to GoDaddy OCSP and CRL URLs (crl.godaddy.com and ocsp.godaddy.com)

TCP/80 to GoDaddy OCSP and CRL URLs (crl.godaddy.com and ocsp.godaddy.com)

TCP/443 to GoDaddy CRL URL (crl.godaddy.com and ocsp.godaddy.com)

TCP/80 to GoDaddy CRL URL (crl.godaddy.com and ocsp.godaddy.com)

6. An administrator wants to block an application by its path instead of reputation. The following steps have already been taken:

Go to Enforce > Policies > Select the desired policy >

Which additional steps must be taken to complete the task?

Click Enforce > Add application path name

Scroll down to the Permissions section > Click Add application path > Enter the path of the desired application

Scroll down to the Blocking and Isolation section > Click Edit (pencil icon) for the desired Reputation

Scroll down to the Blocking and Isolation section > Click Add application path > Enter the path of the desired application

7. An administrator is investigating an alert and reads a summary that says:

The application powershell.exe was leveraged to make a potentially malicious network connection.

Which action should the administrator take immediately to block that connection?

Click Delete Application

Click Quarantine Asset

Click Export Alert

Click Drop Connection

8. Which command is used to immediately terminate a current Live Response session?

kill

detach -q

delete

execfg

9. A user downloaded and executed malware on a system. The malware is actively exfiltrating data.

Which immediate action is recommended to prevent further exfiltration?

Check Security Advisories and Threat Research contents.

Place the device in quarantine.

Run a background scan.

Request upload of the file for analysis.

10. What are the highest and lowest file reputation priorities, respectively, in VMware Carbon Black Cloud?

Priority 1: Ignore, Priority 11: Unknown

Priority 1: Unknown, Priority 11: Ignore

Priority 1: Known Malware, Priority 11: Common White

Priority 1: Company Allowed, Priority 11: Not Listed/Adaptive White

Page 2 of 2

11. An administrator wants to find information about real-world prevention rules that can be used in

VMware Carbon Black Cloud Endpoint Standard.

How can the administrator obtain this information?

Refer to an external report from other security vendors to obtain solutions.

Refer to the TAU-TIN's on the VMware Carbon Black community page.

Refer to the VMware Carbon Black Cloud sensor install guide.

Refer to VMware Carbon Black Cloud user guide.

12. Is it possible to search for unsigned files in the console?

Yes, by using the search: NOT process_publisher_state:FILE_SIGNATURE_STATE_SIGNED

No, it is not possible to return a query for unsigned files.

Yes, by using the search: process_publisher_state:FILE_SIGNATURE_STATE_UNSIGNED

Yes, by looking at signed and unsigned executables in the environment and seeing if another difference can be found, thus locating unsigned files in the environment.

13. The administrator has configured a permission rule with the following options selected:

- Application at path: C:Program Files**

- Operation Attempt: Performs any operation

- Action: Bypass

What is the impact, if any, of using the wildcards in the application at path field?

Executable files in the "Program Files" directory and subdirectories will be ignored.

Executable files in the "Program Files" directory will be blocked.

Executable files in the "Program Files" directory will be logged.

Executable files in the "Program Files" directory will be subject to blocking rules.

14. A script-based attack has been identified that inflicted damage to the corporate systems. The security

administrator found out that the malware was coded into Excel VBA and would like to perform a search to further inspect the incident.

Where in the VMware Carbon Black Cloud Endpoint Standard console can this action be completed?

Endpoints

Settings

Investigate

Alerts

15. An administrator would like to proactively know that something may get blocked when putting a policy rule in the environment.

How can this information be obtained?

Search the data using the test rule functionality. B Examine log files to see what would be impacted

Put the rules in and see what happens to the endpoints. D Determine what would happen based on previously used antivirus software

16. An administrator has just placed an endpoint into bypass.

What type of protection, if any, will VMware Carbon Black provide this device?

VMware Carbon Black will be uninstalled from the endpoint.

VMware Carbon Black will place the machine in quarantine.

VMware Carbon Black will not provide any protection to the endpoint.

VMware Carbon Black will apply policy rules.

17. A security administrator needs to review the Live Response activities and commands that have been executed while performing a remediation process to the sensors.

Where can the administrator view this information in the console?

Users

Audit Log

Notifications

Inbox

18. Which statement accurately characterizes Alerts that are categorized as a "Threat" versus those categorized as "Observed"?

"Threat" indicates an ongoing attack. "Observed" indicates the attack is over and is being watched.

"Threat" indicates a more likely malicious event. "Observed" are less likely to be malicious.

"Threat" indicates a block (Deny or Terminate) has occurred. "Observed" indicates that there is no block.

"Threat" indicates that no block (Deny or Terminate) has occurred. "Observed" indicates a block.

VMware Carbon Black Cloud Endpoint Standard Skills 5V0-93.22 Exam Dumps

VMware Carbon Black Cloud Endpoint Standard Skills 5V0-93.22 Exam Dumps

Share this post

Leave a Reply Cancel reply

Related Posts