Carbon Black Portfolio Skills Free Sample Questions

High Enforcement is the correct security posture for critical servers, as it blocks all unapproved executables by default. However, to accommodate the automated deployment tool that uses dynamic executables, a specific rule must be created. An updatable trust rule or a rule targeting the deployment tool's trusted publisher certificate would allow the patching process to function without compromising the overall security level. Simply using High Enforcement would block the tool, while Medium or Low Enforcement would not provide adequate protection.

This query effectively chains the observed behaviors together. It looks for csc.exe (process_name) that was spawned by powershell.exe (parent_name), which then loaded modules (childproc_modload_count) indicating it wrote and executed a file, and also made a network connection (netconn_count). This combination is highly specific to the suspicious TTP (Tactics, Techniques, and Procedures) and minimizes false positives from legitimate developer activity.

This is the most accurate and efficient query. It correctly selects from the users table (u), filters for local accounts, ensures password_last_set is not zero (which can indicate password never expires), and compares the Unix epoch timestamp of the last set password against the current time minus 90 days in seconds (90 * 24 * 60 * 60 = 7776000). Using epoch time for comparison is the standard and most reliable method in OSQuery/SQLite.

This action directly fulfills the requirement to block all applications categorized as 'Riskware'. This is the primary blocking mechanism.

This action creates the necessary exception. Since permission rules are evaluated before deny rules, this ensures the internally developed, signed tool will be allowed to run, even if it has a 'Riskware' reputation. This is more scalable than whitelisting by hash, as it covers new versions of the tool automatically.

A binary search in Carbon Black EDR is specifically designed for this purpose. It leverages a pre-computed index of all hashes seen in the environment, making it extremely fast for finding where a specific binary exists or has executed. A process search would be slower as it has to search through all process event data.

The statement is false. The 'Allow & Log' action explicitly permits the execution AND generates a corresponding event that is recorded and visible in the App Control console. This is used to permit specific actions while maintaining an audit trail.

When a device is quarantined by Carbon Black Cloud, the sensor blocks all inbound and outbound network connections. However, it explicitly maintains its own connection to the Carbon Black Cloud. This allows administrators to continue managing the sensor, collect data via Live Query, or perform remediation actions via Live Response, while preventing the compromised endpoint from communicating with other systems or attackers.

This option allows an analyst to quickly check the reputation of a hash against a third-party intelligence source, which can inform subsequent hunting queries.

This allows the analyst to immediately run OSQuery against all endpoints to hunt for indicators of compromise (IOCs) or other artifacts related to the alert.

The 'Go Hunt' feature pre-populates the Investigate page with key telemetry from the alert (like process name, hash, command line), allowing the analyst to instantly search for that activity across the entire fleet.

In an on-premises Carbon Black EDR clustered environment, Minion nodes are responsible for receiving raw sensor event data, processing it, and storing it. By deploying Minion nodes at remote sites, sensors at those sites can send their data to the local Minion, which processes it before forwarding the indexed results to the central Master node. This significantly reduces the amount of raw data traversing the WAN link.

Live Response does not have a native delete task command. To interact with system services like the Task Scheduler, you must use the execfg (execute foreground) command to run native OS binaries. schtasks.exe is the correct Windows command-line utility for managing scheduled tasks, and the /delete /tn ... /f arguments will correctly and forcefully remove the specified task.