5V0-91.20 Sample Questions & Answers

The statement is false. The 'Allow & Log' action explicitly permits the execution AND generates a corresponding event that is recorded and visible in the App Control console. This is used to permit specific actions while maintaining an audit trail.

When a device is quarantined by Carbon Black Cloud, the sensor blocks all inbound and outbound network connections. However, it explicitly maintains its own connection to the Carbon Black Cloud. This allows administrators to continue managing the sensor, collect data via Live Query, or perform remediation actions via Live Response, while preventing the compromised endpoint from communicating with other systems or attackers.

This option allows an analyst to quickly check the reputation of a hash against a third-party intelligence source, which can inform subsequent hunting queries.

This allows the analyst to immediately run OSQuery against all endpoints to hunt for indicators of compromise (IOCs) or other artifacts related to the alert.

The 'Go Hunt' feature pre-populates the Investigate page with key telemetry from the alert (like process name, hash, command line), allowing the analyst to instantly search for that activity across the entire fleet.

In an on-premises Carbon Black EDR clustered environment, Minion nodes are responsible for receiving raw sensor event data, processing it, and storing it. By deploying Minion nodes at remote sites, sensors at those sites can send their data to the local Minion, which processes it before forwarding the indexed results to the central Master node. This significantly reduces the amount of raw data traversing the WAN link.

Live Response does not have a native delete task command. To interact with system services like the Task Scheduler, you must use the execfg (execute foreground) command to run native OS binaries. schtasks.exe is the correct Windows command-line utility for managing scheduled tasks, and the /delete /tn ... /f arguments will correctly and forcefully remove the specified task.

This query is the most effective for the auditor. It selects the key identifiable information from the usb_devices table and, crucially, uses a WHERE NOT (...) clause to filter out the compliant, company-issued devices. The result set will therefore only contain USB devices that do not match the approved vendor and product IDs, immediately highlighting all non-compliant connections for the audit report. This directly answers the auditor's need.

The 'Performs any operation' condition is a wildcard that covers all possible actions an application can take. This includes execution ('Runs or is running'), file modifications, registry modifications, and network connections. It is used to create broad rules, such as bypassing all activity from a trusted updater or blocking all activity from a known malicious tool.

In Carbon Black Cloud's policy evaluation logic, permission rules (allow lists) are always evaluated before blocking and isolation rules (deny lists). If an application's behavior matches a permission rule, it is allowed, and processing for that event stops. The blocking rule for code injection will not be evaluated for the trusted tool. This ensures that specific exceptions can be made without weakening the overall security posture.

'ADAPTIVE_WHITE' is a cloud-derived reputation. It indicates that the binary is seen frequently across many organizations, is typically signed by a reputable publisher, and exhibits no malicious behaviors. This helps analysts quickly filter out noise from common, known-good applications like operating system components or popular software.

The statement is true. The on-premises EDR server relies on threat intelligence feeds for context and detection. The default feeds, including critical intelligence from the TAU, are downloaded from the Carbon Black Alliance feed server over the internet. While EDR can function in an air-gapped environment, it would lose this critical, up-to-date threat intelligence context unless feeds are manually imported.