Free 1V0-91.22 sample questions

Correct answer: Process Analysis Tree

The Process Analysis Tree is the specific feature in Carbon Black Cloud designed to provide a graphical, interactive visualization of an entire event chain. It shows the root cause, parent/child process relationships, network connections, and file modifications, which is exactly what the analyst needs for a deep investigation. Live Query is for ad-hoc querying of endpoints, and the Alerts Triage page provides a high-level list of alerts, not the detailed event chain.

Correct answer: NSX Distributed Firewall (DFW)

The NSX Distributed Firewall (DFW) is the core component for implementing micro-segmentation. It operates at the vNIC level of each virtual machine, allowing for stateful firewalling between individual workloads on the same logical network segment. This capability is essential for creating a Zero Trust environment by enforcing least-privilege access and preventing lateral movement. The Gateway Firewall protects North-South traffic, while IDS/IPS and N/S Service Insertion are additional security services, not the fundamental isolation mechanism.

Correct answers: A compliance rule that detects 'Compromised Status'; An action set to 'Enterprise Wipe'

A compliance rule is needed to define the trigger condition. In this case, the rule must be set to detect the 'Compromised Status' of a device, which identifies jailbroken or rooted devices.

An action must be configured to specify what happens when the compliance rule is violated. For this requirement, the action must be set to 'Enterprise Wipe' to remove corporate data and management from the device.

Correct answer: False

This statement is false. A key differentiator of NGAV solutions like Carbon Black Cloud is that they go beyond traditional signature-based detection. They heavily utilize behavioral analysis, machine learning models, and threat intelligence to detect both known and unknown (zero-day) threats based on their actions and patterns, not just their file hash.

Correct answer: The Carbon Black Cloud instance (URL) chosen during registration.

Data residency for Carbon Black Cloud is determined by the specific cloud instance the organization is provisioned on. VMware operates multiple instances in different geographic regions (e.g., prod.eu.confer.net for Europe). This selection is made during the initial organization setup and registration process and dictates where all data for that organization will reside. It cannot be changed after the organization is created.

Correct answer: Create a permission rule that targets the specific build process executable and allows it to perform its operations.

Creating a targeted permission rule is the most secure and precise method. This allows the administrator to specify the exact application (e.g., compiler.exe) and grant it permissions to perform actions that might otherwise be flagged, such as writing new executables. This is far more secure than disabling scanning entirely or creating a broad folder exclusion, which could be exploited by malware. Whitelisting the final executable doesn't help with the performance of the build process itself.

Correct answer: An Ingress rule on the App_Tier group with the source set to the Web_Tier group.

To allow traffic *to* the App_Tier, an Ingress rule must be applied to the App_Tier's security group. The rule's source should be defined as the Web_Tier security group, and the service should be set to TCP port 8443. This correctly implements the required communication path while adhering to the principle of least privilege.

Correct answer: Create an OS Update profile to force the download and installation, and a compliance policy to monitor the OS version.

Workspace ONE UEM provides specific tools for this. An OS Update profile can be configured to schedule and force the download and installation of a specific iOS version. A corresponding compliance policy can then be created to check if the device's OS version is greater than or equal to the required version. If a device is not compliant, the policy can trigger actions like notifications or access restrictions.

Correct answer: Standard

The 'Standard' policy mode is designed for this exact scenario. It automatically blocks processes that are identified as known malware but will only generate alerts (report) for processes that are classified as PUPs or suspicious, allowing an administrator to review them before taking action. 'Advanced' would also block PUPs, and 'Disabled' or 'Non-Malware' would not provide the necessary malware protection.

Correct answer: VMware NSX-T for micro-segmentation, Workspace ONE for device compliance and conditional access, and Carbon Black Cloud for endpoint protection and visibility.

This combination directly addresses all requirements. NSX-T's Distributed Firewall provides micro-segmentation to stop lateral movement (Req 1). Workspace ONE UEM and Access enforce device compliance checks and apply conditional access policies to control access to the EHR portal (Req 2). Carbon Black Cloud deployed on the EHR servers provides advanced threat detection, EDR capabilities for visibility into attacks (Req 3), and integrates with the other solutions for a centrally managed posture (Req 4).