[Jun-2024] Dumps Brief Outline Of The 5V0-93.22 Exam - ExamDumpsVCE
5V0-93.22 Training & Certification Get Latest VMware Security Solutions
The VMware 5V0-93.22 exam is intended for professionals who already have knowledge and experience in managing and configuring VMware products. It is especially suited to cybersecurity professionals looking to increase their knowledge of endpoint security, incident response, and threat management.
NEW QUESTION # 15
An administrator wants to prevent malicious code that has not been seen before from retrieving credentials from the Local Security Authority Subsystem Service, without causing otherwise good applications from being blocked.
Which rule should be used?
- A. [**/*.exe] [Scrapes memory of another process] [Terminate process]
- B. [**\lsass.exe] [Scrapes memory of another process] [Deny operation]
- C. [Unknown application] [Retrieves credentials] [Terminate process]
- D. [Not listed application] [Scrapes memory of another process] [Terminate process]
Answer: D
NEW QUESTION # 16
What is a security benefit of VMware Carbon Black Cloud Endpoint Standard?
- A. Customizable threat feeds that plug into a single agent and single console
- B. A flexible query scheduler that can be used to gather information about the environment
- C. Visibility into the entire attack chain and customizable threat intelligence that can be used to gain insight into problems
- D. Policy rules that can be tested by selecting test rule next to the desired operation attempt
Answer: C
NEW QUESTION # 17
What connectivity is required for VMware Carbon Black Cloud Endpoint Standard to perform Sensor Certificate Validation?
- A. TCP/80 to GoDaddy CRL URL (crl.godaddy.com and ocsp.godaddy.com)
- B. TCP/443 to GoDaddy CRL URL (crl.godaddy.com and ocsp.godaddy.com)
- C. TCP/443 to GoDaddy OCSP and CRL URLs (crl.godaddy.com and ocsp.godaddy.com)
- D. TCP/80 to GoDaddy OCSP and CRL URLs (crl.godaddy.com and ocsp.godaddy.com)
Answer: C
NEW QUESTION # 18
Where can a user identify whether a sensor's signature pack is out-of-date in VMware Carbon Black Cloud?
- A. Inventory > Endpoints > Sensor Update Status
- B. Enforce > Investigate > Sensors > Details
- C. Inventory > Endpoints > Device Name
- D. Enforce > Inventory > Endpoints > Policy
Answer: C
Explanation:
Explanation
To identify whether a sensor's signature pack is out-of-date in VMware Carbon Black Cloud, the user can go to the Inventory page, select the Endpoints tab, and click on the device name of the endpointthey want to check. This will open the Endpoint Details page, where the user can see the Sensor Update Status, which shows the current version and date of the sensor's signature pack, as well as the latest available version and date. If the current version is lower than the latest version, the sensor's signature pack is out-of-date and needs to be updated. References: VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Section 3.2.1: Monitor Sensor Health and Update Status, Page 25.
NEW QUESTION # 19
An administrator needs to find all events on the Investigate page where the process is svchost.exe, and the path is not the standard path of C:\Windows\System32.
Which advanced search will yield these results?
- A. process_name:svchost.exe AND NOT process_name:C:\Windows\System32
- B. process_name:svchost.exe EXCLUDE process_name:C\:\\Windows\\System32
- C. process_name:svchost.exe EXCLUDE process_name:C:\Windows\System32
- D. process_name:svchost.exe AND NOT process_name:C\:\\Windows\\System32
Answer: D
NEW QUESTION # 20
An administrator wants to prevent a spreadsheet from being misused to run malicious code, while minimizing the risk of breaking normal operations of a spreadsheet.
Which rule should be used?
- A. **/Microsoft Excel.app/** [Communicates over the network] [Terminate process]
- B. **\excel.exe [Runs malware] [Deny operation]
- C. **\excel.exe [Invokes a command interpreter] [Deny operation]
- D. **\Microsoft Office\** [Runs external code] [Terminate process]
Answer: C
NEW QUESTION # 21
An administrator wants to prevent ransomware that has not been seen before, without blocking other processes.
Which rule should be used?
- A. [Not listed application] [Performs ransomware-like behavior] [Terminate process
- B. [Adware or PUP] [Scrapes memory of another process] [Deny operation]
- C. [Unknown malware] [Runs or is running] [Terminate process]
- D. [Not listed application] [Runs or is running] [Terminate process]
Answer: A
NEW QUESTION # 22
What are the highest and lowest file reputation priorities, respectively, in VMware Carbon Black Cloud?
- A. Priority 1: Ignore, Priority 11: Unknown
- B. Priority 1: Unknown, Priority 11: Ignore
- C. Priority 1: Company Allowed, Priority 11: Not Listed/Adaptive White
- D. Priority 1: Known Malware, Priority 11: Common White
Answer: A
NEW QUESTION # 23
What is a security benefit of VMware Carbon Black Cloud Endpoint Standard?
- A. Events and alerts are tagged with Carbon Black TTPs to provide context around attacks.
- B. Firewall rule configuration are provided in the environment.
- C. Data leakage protection (DLP) is enforced on endpoints or subsets of endpoints.
- D. Customized threat feeds can be combined with other outside threat intelligence sources.
Answer: A
Explanation:
Explanation
VMware Carbon Black Cloud Endpoint Standard is a next-generation antivirus (NGAV) and behavioral endpoint detection and response (EDR) solution that protects against the full spectrum of modern cyber-attacks. It uses the VMware Carbon Black Cloud's universal agent and console, the solution applies behavioral analytics to endpoint events to streamline detection, prevention, and response to cyber-attacks. One of the security benefits of Endpoint Standard is that it tags events and alerts with Carbon Black TTPs (tactics, techniques, and procedures) to provide context around attacks. Carbon Black TTPs are based on the MITRE ATT&CK framework, which is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. By tagging events and alerts with Carbon Black TTPs, Endpoint Standard helps security teams to understand the nature and scope of the attack, prioritize the most critical threats, and take appropriate actions to remediate them. References: Carbon Black Cloud Endpoint Standard - Technical Overview, VMware Carbon Black Cloud Endpoint Standard Datasheet, MITRE ATT&CK
NEW QUESTION # 24
An organization is implementing policy rules. The administrator mentions that one operation attempt must use a Terminate Process action.
Which operation attempt has this requirement?
- A. Performs ransom ware-like behavior
- B. Runs or is running
- C. Scrapes memory of another process
D Invokes a command interpreter
Answer: A
NEW QUESTION # 25
An administrator needs to configure a policy for macOS and Linux Sensors, not enabling settings which are only applicable to Windows.
Which three settings are only applicable to Sensors on the Windows operating system? (Choose three.)
- A. Delay execute for cloud scan
- B. Allow user to disable protection
- C. Scan execute on network drives
- D. Expedited background scan
- E. Require code to uninstall sensor
- F. Submit unknown binaries for analysis
Answer: A,C,E
NEW QUESTION # 26
An organization is implementing policy rules. The administrator mentions that one operation attempt must use a Terminate Process action.
Which operation attempt has this requirement?
- A. Performs ransom ware-like behavior
- B. Runs or is running
- C. Scrapes memory of another process
D Invokes a command interpreter
Answer: C
Explanation:
Explanation
The operation attempt that must use a Terminate Process action is Scrapes memory of another process. This is a policy rule in VMware Carbon Black Cloud Endpoint Standard that blocks and terminates any process that attempts to read the memory of another process. This is a common technique used by malware to steal sensitive information, such as passwords, encryption keys, or tokens, from legitimate applications. By using a Terminate Process action, the policy rule ensures that the malicious process is stopped and removed from the endpoint, preventing further damage or data exfiltration. The other operation attempts do not require a Terminate Process action, but they can use other actions, such as Alert, Deny, or Isolate Device, depending on the policy configuration and the security needs of the organization. References: Carbon Black Cloud Endpoint Standard - Technical Overview, Best Practices: Endpoint Standard Blocking & Isolation Rules, Endpoint Standard: Deny/Terminate action taken on an Allowed Application
NEW QUESTION # 27
What is a security benefit of VMware Carbon Black Cloud Endpoint Standard?
- A. Events and alerts are tagged with Carbon Black TTPs to provide context around attacks.
- B. Firewall rule configuration are provided in the environment.
- C. Data leakage protection (DLP) is enforced on endpoints or subsets of endpoints.
- D. Customized threat feeds can be combined with other outside threat intelligence sources.
Answer: A
NEW QUESTION # 28
An administrator has configured a terminate rule to prevent an application from running. The administrator wants to confirm that the new rule would have prevented a previous execution that had been observed.
Which feature should the administrator leverage for this purpose?
- A. Configure the rule to terminate the process.
- B. Configure the rule to deny operation of the process.
- C. Setup a notification based on a policy action, and then select Terminate.
- D. Utilize the Test rule link from within the rule.
Answer: D
NEW QUESTION # 29
An organization has found application.exe running on some machines in their Workstations policy.
Application.exe has a SUSPECT_MALWARE reputation and runs from C:\Program Files\IT\Tools. The Workstations policy has the following rules which could apply:
Blocking and Isolation Rule
Application on the company banned list > Runs or is running > Deny
Known malware > Runs or is running > Deny
Suspect malware > Runs or is running > Terminate
Permissions Rule
C:\Program Files\IT\Tools\* > Performs any operation > Bypass
Which action, if any, should an administrator take to ensure application.exe cannot run?
- A. Change the reputation to KNOWN MALWARE to a higher priority.
- B. Add the hash to the company banned list at a higher priority.
- C. Remove the Permissions rule for C:\Program FilesMTVToolsV.
- D. No action needs to be taken as the file will be blocked based on reputation alone.
Answer: C
Explanation:
Explanation
The action that an administrator should take to ensure application.exe cannot run is to remove the Permissions rule for C:\Program Files\IT\Tools*. This is because the Permissions rule has a higher priority than the Blocking and Isolation rule, and it allows any operation on any file in that path, including application.exe. By removing the Permissions rule, the Blocking and Isolation rule will apply and terminate application.exe based on its SUSPECT_MALWARE reputation. The other options are incorrect because they will not prevent application.exe from running. Option A is incorrect because changing the reputation to KNOWN MALWARE will not override the Permissions rule that allows any operation on the file. Option B is incorrect because the file will not be blocked based on reputation alone, as the Permissions rule will bypass the reputation check.
Option D is incorrect because adding the hash to the company banned list will not override the Permissions rule that allows any operation on the file. References: Precedence of Policy Rules, Set Permission Policy Rules, Set Blocking and Isolation Policy Rules
NEW QUESTION # 30
A security administrator is tasked to enable Live Response on all endpoints in a specific policy.
What is the correct path to configure the required sensor policy setting?
- A. Enforce > Policy > Policies > Sensor
- B. Policies > Enforce > Policy > Sensor
- C. Policies > Policy > Sensor > Enforce
- D. Enforce > Policies > Policy > Sensor
Answer: A
NEW QUESTION # 31
A security administrator needs to review the Live Response activities and commands that have been executed while performing a remediation process to the sensors.
Where can the administrator view this information in the console?
- A. Notifications
- B. Users
- C. Audit Log
- D. Inbox
Answer: C
Explanation:
Explanation
The security administrator can view the Live Response activities and commands that have been executed while performing a remediation process to the sensors in the Audit Log page in the VMware Carbon Black Cloud Endpoint Standard console. The Audit Log page allows the administrator to review actions performed by Carbon Black Cloud console users, such as logging in, creating policies, banning hashes, isolating devices, and initiating Live Response sessions. The administrator can use various filters and keywords to narrow down the log scope and find the relevant entries. For example, the administrator can use the following keyword to find all the Live Response activities and commands:
live-response
This keyword will return all the log entries that contain the term live-response, which indicates that the action was related to the Live Response feature. The administrator can also use the following fields to refine the search results:
User: The name of the user who performed the action.
Action: The type of action that was performed, such as login, create, update, delete, enable, disable, and so on.
Object: The object that was affected by the action, such as policy, device, hash, and so on.
Date: The date and time range when the action was performed.
The administrator can also modify the level of granularity of the log entries, expand the log scope, limit the log scope to keywords, modify the audit table configuration, and export audit logs to the local machine1.
The other options are incorrect or irrelevant. Users is a page that allows the administrator to manage the users and roles in the Carbon Black Cloud console, not to view the Live Response activities and commands.
Notifications is a page that allows the administrator to view and manage the notifications from the Carbon Black Cloud console, such as alerts, recommendations, and messages, not to view the Live Response activities and commands. Inbox is a page that allows the administrator to view and manage the messages from the Carbon Black Cloud console, such as product updates, announcements, and feedback requests, not to view the Live Response activities and commands. References:
Audit Logs - VMware Docs, Overview section.
NEW QUESTION # 32
A security administrator is tasked to investigate an alert about a suspicious running process trying to modify a system registry.
Which components can be checked to further inspect the cause of the alert?
- A. Event details, command lines, and TTPs involved
- B. Command lines. Device ID, and priority score
- C. TTPs involved, network connections, and child path
- D. Priority score, file reputation, and timestamp
Answer: A
NEW QUESTION # 33
An administrator wants to block ransomware in the organization based on leadership's growing concern about ransomware attacks in their industry.
What is the most effective way to meet this goal?
- A. Turn on the performs ransomware-like behavior rule in the policies.
- B. Start in the monitored policy until it is clear that no attacks are happening.
- C. Recognize that analytics will automatically block the attacks that may occur.
- D. Look at current attacks to see if the software that is running is vulnerable to potential ransomware attacks.
Answer: A
NEW QUESTION # 34
......
Certification Training for 5V0-93.22 Exam Dumps Test Engine: https://braindump2go.examdumpsvce.com/5V0-93.22-valid-exam-dumps.html
