A company uses Audit and Remediation to check configurations and adhere to compliance
regulations. The regulations require monthly reporting and twelve months of data retained.
How can an administrator accomplish this requirement with Audit and Remediation?
Which list below captures all Enforcement Levels for App Control policies?
An incorrectly constructed watchlist generates 10,000 incorrect alerts.
How should an administrator resolve this issue?
An Enterprise EDR administrator wants to use Watchlists curated by VMware Carbon Black and other
threat intelligence specialists.
How should the administrator add these curated Watchlists from the Watchlists page?
Which identifier is shared by all events when an alert is investigated?
An analyst on the security team noticed that several alerts are false positives within Enterprise EDR.
analyst disables the IOC within the report from those alerts.
Which statement correctly explains what disabling the IOC will accomplish?
What information does the Alert Details panel provide on the Alert Triage page in Endpoint
An analyst is reviewing an alert in Enterprise EDR from a custom watchlist. The analyst disagrees with
the alert severity rating.
How can the analyst change the alert severity value, if this is possible?
An administrator wants to allow files to run from a network share.
Which rule type should the administrator configure?
What is the maximum number of binaries (hashes) that can be banned using the web console?
What are three ways to ignore a feed report within the EDR user interface? (Choose three.)
Given the following query:
SELECT * FROM users WHERE UID >= 500;
Which statement is correct?
An administrator uses the following Enterprise EDR search query to show web browsers spawning
nonbrowser child processes that connect over the network:
(parent_name:chrome.exe OR parent_name:iexplore.exe OR parent_name:firefox.exe) AND (NOT
process_name:chrome.exe OR NOT process_name:iexplore.exe OR NOT process_name:firefox.exe)
Which field can be added to this query to filter the results by signature status?
An administrator runs the following query in Audit and Remediation:
WHERE UID >= 500;
How long will this query stay active and accept data from the sensors?
Which statement is true about configuring VMware Carbon Black Application Control for use on non-
persistent virtual machines (VMs)?