Free 5V0-91.20 sample questions

Correct answer: High Enforcement with a specific updatable trust rule for the deployment tool.

High Enforcement is the correct security posture for critical servers, as it blocks all unapproved executables by default. However, to accommodate the automated deployment tool that uses dynamic executables, a specific rule must be created. An updatable trust rule or a rule targeting the deployment tool's trusted publisher certificate would allow the patching process to function without compromising the overall security level. Simply using High Enforcement would block the tool, while Medium or Low Enforcement would not provide adequate protection.

Correct answer: parent_name:powershell.exe AND process_name:csc.exe AND childproc_modload_count:[1 TO *] AND netconn_count:[1 TO *]

This query effectively chains the observed behaviors together. It looks for `csc.exe` (`process_name`) that was spawned by `powershell.exe` (`parent_name`), which then loaded modules (`childproc_modload_count`) indicating it wrote and executed a file, and also made a network connection (`netconn_count`). This combination is highly specific to the suspicious TTP (Tactics, Techniques, and Procedures) and minimizes false positives from legitimate developer activity.

Correct answer: SELECT u.username, u.password_last_set FROM users u WHERE u.type = 'local' AND u.password_last_set > 0 AND u.password_last_set < (strftime('%s', 'now') - 7776000);

This is the most accurate and efficient query. It correctly selects from the `users` table (`u`), filters for `local` accounts, ensures `password_last_set` is not zero (which can indicate password never expires), and compares the Unix epoch timestamp of the last set password against the current time minus 90 days in seconds (90 * 24 * 60 * 60 = 7776000). Using epoch time for comparison is the standard and most reliable method in OSQuery/SQLite.

Correct answers: Add a rule to the 'Deny' list for applications with the 'Riskware' reputation.; Create a permission rule to allow applications signed by the company's code-signing certificate.

This action directly fulfills the requirement to block all applications categorized as 'Riskware'. This is the primary blocking mechanism.

This action creates the necessary exception. Since permission rules are evaluated before deny rules, this ensures the internally developed, signed tool will be allowed to run, even if it has a 'Riskware' reputation. This is more scalable than whitelisting by hash, as it covers new versions of the tool automatically.

Correct answer: A binary search using the SHA-256 hash.

A binary search in Carbon Black EDR is specifically designed for this purpose. It leverages a pre-computed index of all hashes seen in the environment, making it extremely fast for finding where a specific binary exists or has executed. A process search would be slower as it has to search through all process event data.

Correct answer: False

The statement is false. The 'Allow & Log' action explicitly permits the execution AND generates a corresponding event that is recorded and visible in the App Control console. This is used to permit specific actions while maintaining an audit trail.

Correct answer: All network traffic is blocked except for communication with the Carbon Black Cloud console.

When a device is quarantined by Carbon Black Cloud, the sensor blocks all inbound and outbound network connections. However, it explicitly maintains its own connection to the Carbon Black Cloud. This allows administrators to continue managing the sensor, collect data via Live Query, or perform remediation actions via Live Response, while preventing the compromised endpoint from communicating with other systems or attackers.

Correct answers: Investigate on VirusTotal; Open Live Query; Go Hunt (Investigate page)

This option allows an analyst to quickly check the reputation of a hash against a third-party intelligence source, which can inform subsequent hunting queries.

This allows the analyst to immediately run OSQuery against all endpoints to hunt for indicators of compromise (IOCs) or other artifacts related to the alert.

The 'Go Hunt' feature pre-populates the Investigate page with key telemetry from the alert (like process name, hash, command line), allowing the analyst to instantly search for that activity across the entire fleet.

Correct answer: An EDR Minion node.

In an on-premises Carbon Black EDR clustered environment, Minion nodes are responsible for receiving raw sensor event data, processing it, and storing it. By deploying Minion nodes at remote sites, sensors at those sites can send their data to the local Minion, which processes it before forwarding the indexed results to the central Master node. This significantly reduces the amount of raw data traversing the WAN link.

Correct answer: execfg schtasks.exe /delete /tn MicrosoftUpdater /f

Live Response does not have a native `delete task` command. To interact with system services like the Task Scheduler, you must use the `execfg` (execute foreground) command to run native OS binaries. `schtasks.exe` is the correct Windows command-line utility for managing scheduled tasks, and the `/delete /tn ... /f` arguments will correctly and forcefully remove the specified task.