Free 5V0-93-22 sample questions

Correct answer: Set Carbon Black Intelligence (Cloud) reputation to the highest priority.

Setting Carbon Black Intelligence (Cloud) reputation to the highest priority ensures that known malware and suspicious files identified by VMware's threat intelligence are blocked first. This provides the core security requirement. Since the internal tools are unsigned, prioritizing Company Approved (Signed) would not help and could be complex to manage. Prioritizing IT Tools or ignoring reputation would weaken the security posture unacceptably.

Correct answer: process_name:svchost.exe AND -netconn_domain:corp.local

The correct syntax to exclude a value in a Carbon Black Cloud search query is to prefix the field with a hyphen (-). This query correctly filters for events where the process name is `svchost.exe` and excludes any events where the network connection domain is `corp.local`. The `NOT` operator is not used in this manner for field value exclusion.

Correct answer: Create a Sensor Operation Exclusion for the file path `D:\AppLogs\*`.

A Sensor Operation Exclusion is designed specifically for performance tuning. It instructs the sensor to ignore file, script, and network operations for a specified path or certificate, which directly addresses the high CPU caused by monitoring frequent, benign write operations. Event Reporting Exclusions only stop events from being sent to the cloud, but the sensor still processes them locally. Adding a permission rule doesn't stop the sensor from monitoring the activity, and placing the sensor in bypass mode is a significant security risk.

Correct answer: `cd %temp%`, `get update.dll`

The correct sequence is to first change the current directory to the location of the file using `cd %temp%`, and then use the `get` command to retrieve the file from the endpoint to the Carbon Black Cloud. The `pull` command does not exist. Executing `get` with the full path is also a valid method, but the `cd` command is commonly used to simplify paths. The `memget` command is for retrieving process memory, not files.

Correct answer: The script execution will be blocked because the block on `powershell.exe` takes precedence over any script-specific permissions.

In Carbon Black Cloud's prevention logic, if the interpreter (`powershell.exe` in this case) is explicitly blocked, any scripts that rely on that interpreter will also be blocked, regardless of permissions on the script file itself. The block on the parent process (`powershell.exe`) is enforced before the script is even processed.

Correct answer: True

This is true. The Carbon Black Cloud sensor is designed to operate autonomously. It downloads the latest policy and threat intelligence, allowing it to enforce prevention rules and block threats even when the endpoint is offline or unable to reach the cloud. When connectivity is restored, it uploads the queued event data.

Correct answers: Quarantine the device.; Ban the hash of the offending process.

Correct answer: An operation blocking rule that denies the 'write' operation for file paths matching `*\*.dat` on removable media.

This requirement calls for controlling a specific operation (write) based on file path and device type. An 'operation' blocking rule is the correct tool. It can be configured to target the 'write' operation, specify the file pattern (`*\*.dat`), and apply this logic only when the target media is 'removable'. This provides precise control without blocking legitimate use of USB devices or processes.

Correct answer: The sensor has been uninstalled from the endpoint, and the record will be purged shortly.

The 'Deregistered' status means that the sensor has been properly uninstalled from the endpoint using the command-line with the company deregistration code. The console record is maintained for a short period before being automatically purged. This is different from a sensor that is merely offline or has been manually deleted from the console.

Correct answer: Add the application's hash to the 'Approved List'.

Adding the application's SHA-256 hash to the 'Approved List' (a reputation override) is the most specific and secure method. This action globally designates that specific binary as trusted, ensuring it will run regardless of policy settings or its cloud reputation. Banning it is incorrect. Adding it to the 'IT Tool' list is less definitive and can be overridden by policy. A permission rule is policy-specific, not global.