5V0-91.20 試験問題を無料オンラインアクセス

Which statement correctly defines the results of ignoring a feed report?

• A.Ignoring a feed report will also ignore the threat intelligence feed.
• B.Ignoring a feed report will ignore all indicators in other threat reports.
• C.Ignoring a feed report will ignore future instances of that report.
• D.Ignoring a feed report will remove all instances of the report.

An analyst wants to block an application's specific behavior but does not want to kill the process entirely as it is heavily used on workstations. The analyst needs to use a Blocking and Isolation Action to ensure that the process is kept alive while blocking further unwanted activity.
Which Blocking and Isolation Action should the analyst use to accomplish this goal?

• A.Log Operation
• B.Terminate Process
• C.Deny Operation
• D.Block Process

After an emergency, what does the Restore computer button do on the App Control Home page?

• A.Move all computers to Low Enforcement level
• B.Move all computers to Medium Enforcement level
• C.Move all computers to High Enforcement level
• D.Move all computers to the original Enforcement level

An administrator is concerned that someone may be using unauthorized commands from cmd.exe. These commands are not considered suspicious or malicious, and there is no policy based around them.
Which page should the administrator use to find these commands?

• A.Sensor Management
• B.Policies
• C.Investigate
• D.Alerts

A Carbon Black Cloud analyst needs to identify the Internet Explorer extensions installed on Windows endpoints.
Which Live Query statement will successfully query these items?

• A.SELECT * FROM ie_extensions;
• B.SELECT * FROM ie_extensions WHERE enabled=true;
• C.SELECT * FROM registry WHERE ie_extensions;
• D.SELECT * FROM registry JOIN ie_extensions;