Online Access Free 5V0-93.22 Exam Questions

An administrator needs to create a search, but it must exclude "system.exe".
How should this task be completed?

• A.*process_name:system.exe
• B.#process_name:system.exe
• C.<process_name:system.exe>
• D.-process_name:system.exe

An administrator is investigating an alert and reads a summary that says:
The application powershell.exe was leveraged to make a potentially malicious network connection.
Which action should the administrator take immediately to block that connection?

• A.Click Delete Application
• B.Click Export Alert
• C.Click Drop Connection
• D.Click Quarantine Asset

A recent application has been blocked using hash ban, which is an indicator that some users attempted an unexpected activity. Even though the activity was blocked, the security administrator wants to further investigate the attempt in VMware Carbon Black Cloud Endpoint Standard.
Which page should the administrator navigate to for a graphical view of the event?

• A.Process Analysis
• B.Audit Log
• C.Watchlists
• D.Alert Triage

An administrator needs to use an ID to search and investigate security incidents in Carbon Black Cloud.
Which three IDs may be used for this purpose? (Choose three.)

• A.Threat
• B.Alert
• C.Event
• D.User
• E.Hash
• F.Sensor

A user downloaded and executed malware on a system. The malware is actively exfiltrating data.
Which immediate action is recommended to prevent further exfiltration?

• A.Run a background scan.
• B.Request upload of the file for analysis.
• C.Place the device in quarantine.
• D.Check Security Advisories and Threat Research contents.