1V0-91.22 Sample Questions & Answers

Creating a targeted permission rule is the most secure and precise method. This allows the administrator to specify the exact application (e.g., compiler.exe) and grant it permissions to perform actions that might otherwise be flagged, such as writing new executables. This is far more secure than disabling scanning entirely or creating a broad folder exclusion, which could be exploited by malware. Whitelisting the final executable doesn't help with the performance of the build process itself.

To allow traffic to the App_Tier, an Ingress rule must be applied to the App_Tier's security group. The rule's source should be defined as the Web_Tier security group, and the service should be set to TCP port 8443. This correctly implements the required communication path while adhering to the principle of least privilege.

Workspace ONE UEM provides specific tools for this. An OS Update profile can be configured to schedule and force the download and installation of a specific iOS version. A corresponding compliance policy can then be created to check if the device's OS version is greater than or equal to the required version. If a device is not compliant, the policy can trigger actions like notifications or access restrictions.

The 'Standard' policy mode is designed for this exact scenario. It automatically blocks processes that are identified as known malware but will only generate alerts (report) for processes that are classified as PUPs or suspicious, allowing an administrator to review them before taking action. 'Advanced' would also block PUPs, and 'Disabled' or 'Non-Malware' would not provide the necessary malware protection.

This combination directly addresses all requirements. NSX-T's Distributed Firewall provides micro-segmentation to stop lateral movement (Req 1). Workspace ONE UEM and Access enforce device compliance checks and apply conditional access policies to control access to the EHR portal (Req 2). Carbon Black Cloud deployed on the EHR servers provides advanced threat detection, EDR capabilities for visibility into attacks (Req 3), and integrates with the other solutions for a centrally managed posture (Req 4).

Live Query is the feature designed for this purpose. It uses osquery to allow administrators to run SQL-like queries against endpoints in real-time to gather information about their current state, such as installed applications, running processes, and, in this case, the presence of specific files on the file system. This is a powerful tool for incident response and vulnerability assessment.

NSX-T DFW rules are processed in a top-down, first-match order within a policy section. If a rule with a higher precedence (lower sequence number) explicitly allows SMB traffic between the 'Development' VMs, that rule will be matched first, and processing will stop. The lower-precedence 'block' rule will never be evaluated for that traffic flow. This is a common cause of policy misconfiguration.

Live Response provides security analysts with direct, secure access to an endpoint from the Carbon Black Cloud console. It establishes a remote shell, allowing the analyst to perform deep investigations by browsing the file system, uploading/downloading files (like forensic tools or malware samples), killing processes, and inspecting system state. It is a critical tool for hands-on incident response.

This statement is false. A core benefit of NSX-T micro-segmentation is that it decouples security policy from network topology. Security groups can be defined based on various criteria, such as VM names, tags, OS type, or Active Directory groups, irrespective of their IP address or VLAN/subnet. This allows for granular segmentation of workloads that reside on the same Layer 2 network segment.

Compliance policies frequently include rules that check for a minimum OS version to ensure security patches are applied.

Compliance policies can enforce the presence of specific applications, such as the VMware Hub client or a mobile threat defense app.

A common compliance rule is to require that the device's local storage be encrypted.