[Jan 24, 2024] 5V0-93.22 PDF Recently Updated Questions Dumps to Improve Exam Score [Q28-Q43] – IT Certification Exam Questions & Answers

Rate this post

[Jan 24, 2024] 5V0-93.22 PDF Recently Updated Questions Dumps to Improve Exam Score

5V0-93.22 Dumps Full Questions with Free PDF Questions to Pass

VMware 5V0-93.22 is a certification exam that provides validation of an individual’s knowledge and skills in managing, configuring and deploying VMware Carbon Black Cloud Endpoint Standard solutions. 5V0-93.22 exam tests the candidate’s ability to work with endpoint security solutions which are built on cloud technology.

Certification in VMware Carbon Black Cloud Endpoint Standard Skills can be a valuable asset for IT professionals who work in the area of endpoint security. It can help individuals to demonstrate their expertise to potential employers, and can help to increase their earning potential. Additionally, certification can help individuals to stay up-to-date with the latest trends and best practices in endpoint security, which can be critical in today’s rapidly-evolving cybersecurity landscape.

NO.28 A company wants to prevent an executable from running in their organization. The current reputation for the file is NOT LISTED, and the machines are in the default standard policy.
Which action should be taken to prevent the file from executing?

Add the hash to the MALWARE list.

Use Live Response to kill the process.

Use Live Response to delete the file.

Add the hash to the company banned list.

NO.29 An administrator needs to add an application to the Approved List in the VMware Carbon Black Cloud console.
Which two different methods may be used for this purpose? (Choose two.)

MD5 Hash

Signing Certificate

Application Path

Application Name

IT Tool

Explanation
The VMware Carbon Black Cloud Endpoint Standard allows administrators to add applications to the Approved List, which approves the presence and actions of specified applications on the endpoints. Adding to the Approved List is global in its effects and applies to all policies attached to a particular version of an application. There are two different methods that can be used to add applications to the Approved List: by signing certificate or by application path.
By signing certificate: This method allows administrators to approve files that are signed by a specific certificate authority (CA) or signer. For example, if an administrator wants to approve all files that are signed by Google Inc, they can add the signer name and the CA name to the Approved List. This method is useful for approving files that are frequently updated or have dynamic names or paths.
However, administrators should be careful when using wildcards or approving certificates from untrusted sources, as this could lead to incidentally approving malicious software that appears to be signed by a trusted CA or signer.
By application path: This method allows administrators to approve files that are located in a specific path on the endpoint. For example, if an administrator wants to approve a custom application that is installed in C:\Program Files\Custom Application\, they can add the path and the file name to the Approved List. This method is useful for approving files that have a fixed name and location on the endpoint. However, administrators should be aware that this method does not account for new versions of the application, and they should routinely update the Approved List to reflect the changes.
Administrators can also use wildcards to target certain files or directories, but they should be as specific as possible to avoid approving unwanted files.
The other options are not valid methods for adding applications to the Approved List. MD5 hash is a method for adding files to the Banned List, which prevents specific files from running on the endpoints by their hash values. Application name is a method for creating permission rules, which allow or deny the presence and actions of an application only on a specific device. IT Tool is not a method, but a category of applications that are recommended to be added to the Approved List, such as software deployment tools, executable installers, IDEs, compilers, or script editors. References: Adding to the Approved List, Endpoint Standard: How to add a Certificate to the Approved List, Endpoint Standard: How to add a SHA256 hash to Approved/Banned List

NO.30 An administrator needs to fully analyze the relevant information of an event stored in the VMware Carbon Black Cloud.
On which page can this information be found?

Enforce

Investigate

Live Query

Inventory

NO.31 A company wants to prevent an executable from running in their organization. The current reputation for the file is NOT LISTED, and the machines are in the default standard policy.
Which action should be taken to prevent the file from executing?

Add the hash to the MALWARE list.

Use Live Response to kill the process.

Use Live Response to delete the file.

Add the hash to the company banned list.

NO.32 What is a capability of VMware Carbon Black Cloud?

Continuous and decentralized recording

Attack chain visualization and search

Real-time view of attackers

Automation via closed SOAP APIs

NO.33 An organization has found application.exe running on some machines in their Workstations policy.
Application.exe has a SUSPECT_MALWARE reputation and runs from C:Program FilesITTools. The Workstations policy has the following rules which could apply:
Blocking and Isolation Rule
Application on the company banned list > Runs or is running > Deny
Known malware > Runs or is running > Deny
Suspect malware > Runs or is running > Terminate
Permissions Rule
C:Program FilesITTools* > Performs any operation > Bypass
Which action, if any, should an administrator take to ensure application.exe cannot run?

Change the reputation to KNOWN MALWARE to a higher priority.

No action needs to be taken as the file will be blocked based on reputation alone.

Remove the Permissions rule for C:Program FilesMTVToolsV.

Add the hash to the company banned list at a higher priority.

NO.34 A security administrator is tasked to investigate an alert about a suspicious running process trying to modify a system registry.
Which components can be checked to further inspect the cause of the alert?

Command lines. Device ID, and priority score

Event details, command lines, and TTPs involved

TTPs involved, network connections, and child path

Priority score, file reputation, and timestamp

Explanation
These components can provide more information about the suspicious running process and its behavior, such as:
Event details: This component shows the details of the event that triggered the alert, such as the device name, the device time, the process name, the process path, the process ID, the operation type, the operation result, the registry key, the registry value, and the registry data. The event details can help the security administrator to identify the source and the target of the registry modification attempt, and to verify if the operation was successful or not.
Command lines: This component shows the command lines that were executed by the process or its parent process, such as the arguments, the parameters, the switches, and the environment variables. The command lines can help the security administrator to understand the purpose and the context of the process execution, and to detect any malicious or anomalous commands or scripts.
TTPs involved: This component shows the tactics, techniques, and procedures (TTPs) that were involved in the event, based on the MITRE ATT&CK framework. The TTPs can help the security administrator to assess the severity and the impact of the event, and to correlate the event with other related events or indicators of compromise.
The other components are not as useful or relevant for investigating the alert. A. Device ID and priority score are components that provide general information about the device and the alert, but they do not provide specific details about the suspicious running process or its behavior. C. Network connections and child path are components that show the network activity and the child processes of the suspicious running process, but they do not show the registry modification attempt or its result. D. File reputation and timestamp are components that show the reputation and the time of the file associated with the suspicious running process, but they do not show the command lines orthe TTPs involved in the event. References: VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 2.3.2: Investigate Alerts, Page 16.

NO.35 A recent application has been blocked using hash ban, which is an indicator that some users attempted an unexpected activity. Even though the activity was blocked, the security administrator wants to further investigate the attempt in VMware Carbon Black Cloud Endpoint Standard.
Which page should the administrator navigate to for a graphical view of the event?

Audit Log

Watchlists

Process Analysis

Alert Triage

NO.36 Which scenario would qualify for the “Local White” Reputation?

The file was added as an IT took

The file was signed using a trusted certificate.

The hash was not on any known good or known bad lists, AND the file is signed.

The hash was previously analyzed, AND it is not on any known good or bad lists.

NO.37 An administrator has been tasked with preventing the use of unauthorized USB storage devices from being used in the environment.
Which item needs to be enabled in order to enforce this requirement?

Enable the Block access to all unapproved USB devices within the policies option.

Choose to disable USB device access on each endpoint from the Inventory page.

Select the option to block USB devices from the Reputation page.

Elect to approve only allowed USB devices from the USB Devices page.

NO.38 An administrator has configured a terminate rule to prevent an application from running. The administrator wants to confirm that the new rule would have prevented a previous execution that had been observed.
Which feature should the administrator leverage for this purpose?

Setup a notification based on a policy action, and then select Terminate.

Utilize the Test rule link from within the rule.

Configure the rule to terminate the process.

Configure the rule to deny operation of the process.

NO.39 An administrator wants to prevent malicious code that has not been seen before from retrieving credentials from the Local Security Authority Subsystem Service, without causing otherwise good applications from being blocked.
Which rule should be used?

[Unknown application] [Retrieves credentials] [Terminate process]

[**/*.exe] [Scrapes memory of another process] [Terminate process]

[**lsass.exe] [Scrapes memory of another process] [Deny operation]

[Not listed application] [Scrapes memory of another process] [Terminate process]

NO.40 An administrator has configured a permission rule with the following options selected:
Application at path: C:Program Files**
Operation Attempt: Performs any operation
Action: Bypass
What is the impact, if any, of using the wildcards in the path?

All executable files in the “Program Files” folder and subfolders will be ignored, includingmalware files.

No Files will be ignored from the “Program Files” director/, but Malware in the “Program Files” directory will continue to be blocked.

Executable files in the “Program Files” folder will be blocked.

Only executable files in the “Program Files” folder will be ignored, includingmalware files.

NO.41 An organization is implementing policy rules. The administrator mentions that one operation attempt must use a Terminate Process action.
Which operation attempt has this requirement?

Performs ransom ware-like behavior

Runs or is running

Scrapes memory of another process
D Invokes a command interpreter

NO.42 A security administrator needs to review the Live Response activities and commands that have been executed while performing a remediation process to the sensors.
Where can the administrator view this information in the console?

Users

Audit Log

Notifications

Inbox

Explanation
The security administrator can view the Live Response activities and commands that have been executed while performing a remediation process to the sensors in the Audit Log page in the VMware Carbon Black Cloud Endpoint Standard console. The Audit Log page allows the administrator to review actions performed by Carbon Black Cloud console users, such as logging in, creating policies, banning hashes, isolating devices, and initiating Live Response sessions. The administrator can use various filters and keywords to narrow down the log scope and find the relevant entries. For example, the administrator can use the following keyword to find all the Live Response activities and commands:
live-response
This keyword will return all the log entries that contain the term live-response, which indicates that the action was related to the Live Response feature. The administrator can also use the following fields to refine the search results:
User: The name of the user who performed the action.
Action: The type of action that was performed, such as login, create, update, delete, enable, disable, and so on.
Object: The object that was affected by the action, such as policy, device, hash, and so on.
Date: The date and time range when the action was performed.
The administrator can also modify the level of granularity of the log entries, expand the log scope, limit the log scope to keywords, modify the audit table configuration, and export audit logs to the local machine1.
The other options are incorrect or irrelevant. Users is a page that allows the administrator to manage the users and roles in the Carbon Black Cloud console, not to view the Live Response activities and commands.
Notifications is a page that allows the administrator to view and manage the notifications from the Carbon Black Cloud console, such as alerts, recommendations, and messages, not to view the Live Response activities and commands. Inbox is a page that allows the administrator to view and manage the messages from the Carbon Black Cloud console, such as product updates, announcements, and feedback requests, not to view the Live Response activities and commands. References:
Audit Logs – VMware Docs, Overview section.

NO.43 Which command is used to immediately terminate a current Live Response session?

kill

detach -q

delete

execfg