Online Access Free 5V0-91.20 Exam Questions

An analyst is investigating an alert within Enterprise EDR on the process analysis page. The process tree can be seen below:

Which statement accurately characterizes this situation?

• A.Conhost.exe has one or more child processes.
• B.The solid line between the nodes denotes a process was injected into by another process.
• C.Several nodes in this process tree have watchlist hits.
• D.The analyst navigated to this process analysis page from the wscrlpt.exe process.

An Endpoint Standard administrator finds a binary in the environment and decides to manually add the file hash to the Banned List.
Which reputation does the file now have?

• A.Company Black
• B.Suspect/Heuristic Malware
• C.Known Malware
• D.Adware/PUP Malware

How often do watchlists run?

• A.Every 10 minutes
• B.Watchlists can be configured to run at scheduled intervals
• C.Every 5 minutes
• D.Every 30 minutes

Which identifier is shared by all events when an alert is investigated?

• A.Alert ID
• B.Process ID
• C.Priority Score
• D.Event ID

A company wants to implement the strictest security controls for computers on which the software seldom changes (i.e., servers or single-purpose systems).
Which Enforcement Level is the most fitting?

• A.High Enforcement
• B.None (Visibility)
• C.Medium Enforcement
• D.Low Enforcement