VMware VMware Certifications 5V0-91.20 Questions & Answers

• Question 21:

  An administrator runs the following query in Audit and Remediation:

  SELECT *

  FROM users

  WHERE UID >= 500;

  How long will this query stay active and accept data from the sensors?

  A. 1 day

  B. 7 days

  C. 14 days

  D. 30 days

  Correct Answer: D

• Question 22:

  This search is entered into the process search page: notepad.exe Which three statements about this query are true? (Choose three.)

  A. Only processes named notepad.exe will be returned.

  B. Since a field name is not selected, query performance will be impacted.

  C. A field identifier is required for all criteria within a process search.

  D. The search will fail with an error.

  E. All processes containing the text notepad.exe in any default field.

  F. Processes with registry modifications containing notepad.exe would be retuned.

  Correct Answer: BEF

• Question 23:

  An administrator needs to manage a group of sensors from within the console.

  Which three actions are available for sensors within the Sensor Group? (Choose three.)

  A. Move to group

  B. Disable

  C. Restart

  D. Ban

  E. Uninstall

  F. Share Settings

  Correct Answer: ACE

• Question 24:

  Which wildcard configuration applies a policy to all files and subfolders in a specific folder in Endpoint Standard?

  A. C:\Program Files\example\$$

  B. C:\Program Files\example\**

  C. C:\Program Files\example\$

  D. C:\Program Files\example\*

  Correct Answer: B

  Reference: https://community.carbonblack.com/t5/Knowledge-Base/Endpoint-Standard-How-to-CreatePolicy-Blocking-Isolation-and/ta-p/65941

• Question 25:

  How is a new Alert of type Event Alert created whenever an endpoint is added or deleted and send emails for the App Control admin whenever these events occur?

  A. Add filter in Event Properties for Subtype Endpoint added and Endpoint deleted. Click Create and add the App Control admin email, and then click Create and. Exit.

  B. Add filter in Event Properties for Subtype Computer added and Computer deleted. Add the App Control admin email, and then click Create and Exit.

  C. Add filter in Event Properties for Subtype Computer added and Computer deleted. Click Create and add the App Control admin email, and then click Create and Exit.

  D. Add filter in Event Properties for Subtype Computer modified. Add the App Control admin email, and then click Create and Exit.

  Correct Answer: D

• Question 26:

  Which statement is true about configuring VMware Carbon Black Application Control for use on non-persistent virtual machines (VM's)?

  A. The endpoint housing the agent template must always be on/running except when updating the image.

  B. The gold image housing the agent template must be digitally signed to ensure the integrity of the agent cache.

  C. The endpoint housing the agent template must always be off except when updating the image.

  D. The agent running on the template machine must not be initialized before deploying clones.

  Correct Answer: D

• Question 27:

  Which enforcement level does not block unapproved files but will block files that have been specifically banned?

  A. Medium Enforcement

  B. Disabled

  C. Visibility

  D. Low Enforcement

  Correct Answer: B

  Explanation: The protection level applied to computers running the App Control Agent. A range of levels from High (Block Unapproved) to None (Disabled) enable you to specify the level of file blocking required.

• Question 28:

  An administrator needs to check configurations using Audit across several policies and locations within the organization.

  How can the administrator run the query to only these specific devices?

  A. Specify endpoints on the query by selecting the check box for each device.

  B. Specify endpoints on the query by typing the sensor name into the text box, selecting the device. Repeat as necessary for all devices.

  C. Specify the policy for the endpoints on the query, and then select the check box for each device.

  D. Specify the policy for the endpoints on the query, and then type the sensor name into the text box, selecting the devices. Repeat as necessary for all devices.

  Correct Answer: D

• Question 29:

  Which actions are available for Permissions?

  A. Approve, Upload, No Upload

  B. Deny Operation, Terminate Process

  C. Allow, Allow and Log, Bypass

  D. Performs any Operation, Runs or is running

  Correct Answer: C

• Question 30:

  At which three frequencies may a Carbon Black Audit and Remediation administrator schedule the run of Live Queries? (Choose three.)

  A. Monthly

  B. Daily

  C. Bi-Weekly

  D. Weekly

  E. Hourly

  F. Any frequency

  Correct Answer: ABD