VMware Carbon Black Cloud Endpoint Standard Skills Free Sample Questions

Setting Carbon Black Intelligence (Cloud) reputation to the highest priority ensures that known malware and suspicious files identified by VMware's threat intelligence are blocked first. This provides the core security requirement. Since the internal tools are unsigned, prioritizing Company Approved (Signed) would not help and could be complex to manage. Prioritizing IT Tools or ignoring reputation would weaken the security posture unacceptably.

The correct syntax to exclude a value in a Carbon Black Cloud search query is to prefix the field with a hyphen (-). This query correctly filters for events where the process name is svchost.exe and excludes any events where the network connection domain is corp.local. The NOT operator is not used in this manner for field value exclusion.

A Sensor Operation Exclusion is designed specifically for performance tuning. It instructs the sensor to ignore file, script, and network operations for a specified path or certificate, which directly addresses the high CPU caused by monitoring frequent, benign write operations. Event Reporting Exclusions only stop events from being sent to the cloud, but the sensor still processes them locally. Adding a permission rule doesn't stop the sensor from monitoring the activity, and placing the sensor in bypass mode is a significant security risk.

The correct sequence is to first change the current directory to the location of the file using cd %temp%, and then use the get command to retrieve the file from the endpoint to the Carbon Black Cloud. The pull command does not exist. Executing get with the full path is also a valid method, but the cd command is commonly used to simplify paths. The memget command is for retrieving process memory, not files.

In Carbon Black Cloud's prevention logic, if the interpreter (powershell.exe in this case) is explicitly blocked, any scripts that rely on that interpreter will also be blocked, regardless of permissions on the script file itself. The block on the parent process (powershell.exe) is enforced before the script is even processed.

This is true. The Carbon Black Cloud sensor is designed to operate autonomously. It downloads the latest policy and threat intelligence, allowing it to enforce prevention rules and block threats even when the endpoint is offline or unable to reach the cloud. When connectivity is restored, it uploads the queued event data.

This requirement calls for controlling a specific operation (write) based on file path and device type. An 'operation' blocking rule is the correct tool. It can be configured to target the 'write' operation, specify the file pattern (*\*.dat), and apply this logic only when the target media is 'removable'. This provides precise control without blocking legitimate use of USB devices or processes.

The 'Deregistered' status means that the sensor has been properly uninstalled from the endpoint using the command-line with the company deregistration code. The console record is maintained for a short period before being automatically purged. This is different from a sensor that is merely offline or has been manually deleted from the console.

Adding the application's SHA-256 hash to the 'Approved List' (a reputation override) is the most specific and secure method. This action globally designates that specific binary as trusted, ensuring it will run regardless of policy settings or its cloud reputation. Banning it is incorrect. Adding it to the 'IT Tool' list is less definitive and can be overridden by policy. A permission rule is policy-specific, not global.