Online Access Free 5V0-91.20 Exam Questions

An analyst wants to block an application's specific behavior but does not want to kill the process entirely as it is heavily used on workstations. The analyst needs to use a Blocking and Isolation Action to ensure that the process is kept alive while blocking further unwanted activity.
Which Blocking and Isolation Action should the analyst use to accomplish this goal?

• A.Deny Operation
• B.Block Process
• C.Log Operation
• D.Terminate Process

A Carbon Black Cloud analyst needs to identify the Internet Explorer extensions installed on Windows endpoints.
Which Live Query statement will successfully query these items?

• A.SELECT * FROM registry JOIN ie_extensions;
• B.SELECT * FROM ie_extensions;
• C.SELECT * FROM ie_extensions WHERE enabled=true;
• D.SELECT * FROM registry WHERE ie_extensions;

An administrator runs the following query in Audit and Remediation:
SELECT *
FROM users
WHERE UID >= 500;
How long will this query stay active and accept data from the sensors?

• A.1 day
• B.14 days
• C.30 days
• D.7 days

Which ID in Endpoint Standard is associated with one specific action, involves up to three different hashes (Parent, Process, Target), and occurs on a single device at a specific time?

• A.Alert ID
• B.Threat ID
• C.Process ID
• D.Event ID

An administrator is reviewing an alert about a known and required application in the environment. The application has been given the reputation of PUP, with the alert reason being that the PUP was detected. As a result, this application is matching policy blocking & isolation rules for PUPs in the environment and Is not behaving as expected.
Which step should the administrator take to remediate this situation?

• A.Dismiss the alert
• B.Add the file to the Banned List and Delete application
• C.Add the file to the Approved List
• D.Add the file to the Approved List and Dismiss alert