An alert for a device running a proprietary application is tied to a vital business operation. Which action is appropriate to take? A. Add the application to the Approved List. B. Terminate the process. C. Deny the operation. D. Quarantine…
Which wildcard configuration applies a policy to all files and subfolders in a specific folder in Endpoint Standard? A. C:Program Filesexample$$ B. C:Program Filesexample** C. C:Program Filesexample$ D. C:Program Filesexample*
Which statement should be used when constructing queries in Carbon Black Audit and Remediation, Live Query? A. ALTER B. UPDATE C. REMOVE D. SELECT
How often do watchlists run? A. Every 10 minutes B. Every 5 minutes C. Watchlists can be configured to run at scheduled intervals D. Every 30 minutes
An organization leverages a commonly used software distribution tool to manage deployment of enterprise software and updates. Custom rules are a suitable option to ensure the approval of files delivered by this tool. Which other trust mechanism could the organization…
Refer to the exhibit: Which two logic statements correctly explain filtering within the UI? (Choose two.) A. Filtering between fields is a logical OR B. Filtering within the same field is a logical AND C. Filtering between fields is a…
An administrator wants to query the status of the firewall for all endpoints. The administrator will query the registry key found here HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile. To make the results easier to understand, the administrator wants to return either enabled or disabled for…
An analyst wants to block an application’s specific behavior but does not want to kill the process entirely as it is heavily used on workstations. The analyst needs to use a Blocking and Isolation Action to ensure that the process…
App Control System Health email alerts for excessive agent backlog are occurring hourly. This is overwhelming the analysts, and they would like to reduce the notifications. How can the analyst reduce the unneeded alerts? A. Set the email address for…
An administrator needs to query all endpoints in the HR group for instances of an obfuscated copy of cmd.exe. Given this Enterprise EDR query: process_name:cmd.exe AND device_group:HR AND NOT enriched:true Which example could be added to the query to provide…