5V0-91.20 sample questions

Question 1

An administrator for a large retail company is using Carbon Black Cloud Audit and Remediation to verify PCI-DSS compliance. They need to generate a report of all local user accounts that have password last set dates older than 90 days on all Windows-based point-of-sale terminals. Which Live Query is correctly structured to retrieve this information efficiently?

Accepted Answer

SELECT u.username, u.password_last_set FROM users u WHERE u.type = 'local' AND u.password_last_set > 0 AND u.password_last_set < (strftime('%s', 'now') - 7776000);

Answer

SELECT username, password_last_set FROM users;

Answer

SELECT username, password_last_set FROM users WHERE password_last_set < 'now - 90 days';

Answer

SELECT * FROM users JOIN logon_history ON users.uid = logon_history.uid WHERE logon_history.time < (strftime('%s', 'now') - 7776000);

Question 2

A security team is migrating from a legacy AV solution to Carbon Black Cloud Endpoint Standard. They have a policy requirement to block the execution of all applications categorized as 'Riskware' but must allow a specific, internally developed tool that is sometimes flagged as such. The tool is signed with the company's code-signing certificate. Which two actions should be taken within the policy configuration to meet this requirement? (Select TWO)

Accepted Answer

Add a rule to the 'Deny' list for applications with the 'Riskware' reputation.

Accepted Answer

Create a permission rule to allow applications signed by the company's code-signing certificate.

Answer

Create a permission rule to allow the specific SHA-256 hash of the internal tool.

Answer

Set the policy's mode to 'Bypass' for all endpoints.

Answer

Add the IP addresses of the development servers to the network allow list.

Question 3

During an incident response scenario using on-premises VMware Carbon Black EDR, an analyst needs to find all endpoints where a malicious binary, `evil.exe`, has been seen. The search must be as fast as possible to scope the incident quickly. The analyst only has the binary's SHA-256 hash. Which search method should the analyst use?

Accepted Answer

A binary search using the SHA-256 hash.

Answer

A process search using `process_name:evil.exe`.

Answer

A watchlist configured with the hash and waiting for alerts.

Answer

A feed search using a custom threat feed containing the hash.

Question 4

True or False: In VMware Carbon Black App Control, a rule set to 'Allow & Log' for an unapproved application will permit the application to execute but will not generate an event visible on the console.

Accepted Answer

False

Answer

True

Question 5

An organization is using Carbon Black Cloud Endpoint Standard. A security administrator has configured a policy that places devices into quarantine upon detecting a high-severity threat. What is the effect of this quarantine action on the endpoint?

```mermaid
graph TD
subgraph Endpoint [Quarantined Endpoint]
A[Sensor] --> B{CBC Cloud}
C(Internal Network) -.-> D{No Connection}
E(Internet) -.-> D
end
B -- Manages --> A
A -. Blocks .-> C
A -. Blocks .-> E
```

Accepted Answer

All network traffic is blocked except for communication with the Carbon Black Cloud console.

Answer

All network traffic to and from the device is blocked, including communication with the Carbon Black Cloud.

Answer

The device is powered down remotely by the sensor.

Answer

Only inbound network traffic is blocked; outbound traffic is allowed for logging purposes.

Question 6

A SOC manager is reviewing the alert triage process for their team, who use Carbon Black Cloud Enterprise EDR. The manager wants to ensure analysts can quickly pivot from an alert to proactively hunt for related activity on other endpoints. Which three features, directly accessible from the alert triage page, facilitate this workflow? (Choose THREE)

Accepted Answer

Investigate on VirusTotal

Accepted Answer

Open Live Query

Accepted Answer

Go Hunt (Investigate page)

Answer

Export to CSV

Answer

Add Note

Answer

Change Policy

Question 7

A consultant is deploying on-premises Carbon Black EDR for a client with a large, geographically distributed network connected by high-latency WAN links. To optimize performance and reduce data transfer over the WAN, sensor data from remote sites should be processed locally before being forwarded to the central EDR cluster. Which EDR component should be deployed at the remote sites to achieve this?

Accepted Answer

An EDR Minion node.

Answer

A dedicated EDR Sensor group for each site.

Answer

An EDR Forwarder node.

Answer

A Solr Indexer node.

Question 8

An administrator needs to use Live Response to remove a persistence mechanism created by malware on a Windows endpoint. The malware created a scheduled task named `MicrosoftUpdater`. Which Live Response command should be used to delete this task?

Accepted Answer

execfg schtasks.exe /delete /tn MicrosoftUpdater /f

Answer

delete task MicrosoftUpdater

Answer

reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdater

Answer

kill process MicrosoftUpdater

Question 9

**Case Study:**

A healthcare organization, HealthCorp, uses VMware Carbon Black across its portfolio to protect patient data and ensure HIPAA compliance. They use App Control on critical Electronic Health Record (EHR) servers, Cloud Endpoint Standard on clinical workstations, and Audit & Remediation for compliance checks.

During a routine audit, an analyst needs to prove that no unauthorized USB devices have been connected to the EHR servers in the past 6 months. The App Control policy on these servers is in High Enforcement, and USB device access is controlled via specific rules. The analyst must use Live Query to verify that the controls are working as expected and to list any USB devices that were connected.

The security policy states that only company-issued, encrypted USB drives are permitted. These drives are from a specific vendor (VID 0x0781) and have a specific product ID (PID 0x5581). All other USB devices should be blocked and logged.

Which Live Query query would provide the auditor with a comprehensive list of all USB devices connected to the EHR servers, allowing them to easily identify any non-compliant devices?

Accepted Answer

SELECT vendor, vendor_id, model, model_id, serial FROM usb_devices WHERE NOT (vendor_id = '0781' AND model_id = '5581');

Answer

SELECT * FROM usb_devices;

Answer

SELECT device, vendor_id, product_id, serial FROM usb_devices;

Answer

SELECT * FROM usb_devices WHERE vendor_id = '0781' AND model_id = '5581';

Question 10

When configuring a custom rule in VMware Carbon Black App Control, what is the primary function of the 'Perform any operation' condition?

Accepted Answer

To create a comprehensive rule that applies to all actions taken by the specified application, including execution, file/reg mods, and network connections.

Answer

To monitor only when a file is executed or a process is running.

Answer

To track file writes, registry modifications, and network connections, but not execution.

Answer

To apply the rule only to network connections initiated by the application.

Free 5V0-91.20 sample questions

True or False: In VMware Carbon Black App Control, a rule set to 'Allow & Log' for an unapproved application will permit the application to execute but will not generate an event visible on the console.

An administrator needs to use Live Response to remove a persistence mechanism created by malware on a Windows endpoint. The malware created a scheduled task named `MicrosoftUpdater`. Which Live Response command should be used to delete this task?

When configuring a custom rule in VMware Carbon Black App Control, what is the primary function of the 'Perform any operation' condition?

10 more free samples are waiting