A company uses Audit and Remediation to check configurations and adhere to compliance regulations. The regulations require monthly reporting and twelve months of data retained. How can an administrator accomplish this requirement with Audit and Remediation? A. Schedule the query…
Which list below captures all Enforcement Levels for App Control policies? A. Critical, Lockdown, Monitored, Tracking, Banning B. High Enforcement, Medium Enforcement, Low Enforcement C. High Enforcement, Medium Enforcement, Low Enforcement, None (Visibility), None (Disabled) D. Control, Local Approval, Disabled
An incorrectly constructed watchlist generates 10,000 incorrect alerts. How should an administrator resolve this issue? A. Delete the watchlist to automatically clear the alerts, and then create a new watchlist with the correct criteria. B. From the Triage Alerts Page,…
An Enterprise EDR administrator wants to use Watchlists curated by VMware Carbon Black and other threat intelligence specialists. How should the administrator add these curated Watchlists from the Watchlists page? A. Click Add Watchlists, and input the URL(s) for the…
Which identifier is shared by all events when an alert is investigated? A. Process ID B. Event ID C. Priority Score D. Alert ID
An analyst on the security team noticed that several alerts are false positives within Enterprise EDR. The analyst disables the IOC within the report from those alerts. Which statement correctly explains what disabling the IOC will accomplish? A. That specific…
What information does the Alert Details panel provide on the Alert Triage page in Endpoint Standard? A. Threat ID B. Process ID C. Device ID D. Alert ID
An analyst is reviewing an alert in Enterprise EDR from a custom watchlist. The analyst disagrees with the alert severity rating. How can the analyst change the alert severity value, if this is possible? A. The alert severity is assigned…
An administrator wants to allow files to run from a network share. Which rule type should the administrator configure? A. Execute Prompt (Shared Path) B. Trusted Path C. Network Execute (Allow) D. Write Approve (Network)
What is the maximum number of binaries (hashes) that can be banned using the web console? A. 500 B. 600 C. 300 D. 400