5V0-91.20 試験問題を無料オンラインアクセス

An Enterprise EDR administrator is reviewing the Investigate page and believes they are receiving false positive hits from specific watchlist.
Which three options reduce future false positive hits from this watchlist? (Choose three.)

• A.Dismiss the watchlist hit.
• B.Select edit watchlist and uncheck alert on hits.
• C.Disable/remove the IOC associated with the false positives.
• D.Modify policy rules to exclude the false positive directory.
• E.Disable the watchlist associated with the false positives.
• F.Disable/remove the report associated with the false positives.

An analyst is investigating an alert within Enterprise EDR on the process analysis page. The process tree can be seen below:

Which statement accurately characterizes this situation?

• A.The solid line between the nodes denotes a process was injected into by another process.
• B.Conhost.exe has one or more child processes.
• C.Several nodes in this process tree have watchlist hits.
• D.The analyst navigated to this process analysis page from the wscrlpt.exe process.

A Carbon Black Cloud Endpoint Standard analyst is testing different search operator combinations.
Which two queries produce the same result? (Choose two.)

• A.process_name:chrome.exe netconn_domain:google.com
• B.process_narne:chrome.exe NOT netconn_domain:google.com
• C.process_name:chrome.exe AND NOT netconn_domain:google.com
• D.process_name:chrome.exe OR netconn_domain:google.com
• E.process_name:chrome.exe OR NOT netconn_domain:google.com

In which two ways can the tamper protection on an App Control agent be disabled when diagnosing agent issues or removing the agent? (Choose two.)

• A.From the File Catalog page on the web console
• B.Run RepCLI on Windows command prompt
• C.From the Files on Computers page on the web console
• D.Run authenticated DasCLI on Windows command prompt
• E.From the Computer Details page on the web console

Which statement correctly defines the results of ignoring a feed report?

• A.Ignoring a feed report will remove all instances of the report.
• B.Ignoring a feed report will also ignore the threat intelligence feed.
• C.Ignoring a feed report will ignore future instances of that report.
• D.Ignoring a feed report will ignore all indicators in other threat reports.