An administrator needs to check configurations using Audit across several policies and locations within the organization.
How can the administrator run the query to only these specific devices?
How can an analyst disregard alerts on multiple devices with the least amount of administrative effort?
An administrator runs the following query in Audit and Remediation:
SELECT *
FROM users
WHERE UID >= 500;
How long will this query stay active and accept data from the sensors?
A Carbon Black Cloud Endpoint Standard analyst is testing different search operator combinations.
Which two queries produce the same result? (Choose two.)
Which statement is true about configuring VMware Carbon Black Application Control for use on non-persistent virtual machines (VM’s)?
Which two statements are true regarding Live Response? (Choose two.)
An Endpoint Standard administrator is working with an IT team to explicitly permit specific applications from the environment using both the IT Tools and Certs Approved List features.
Once applied, which reputation would these applications be classified under for processing?
An Enterprise EDR administrator has created a custom Watchlist and wants to add a custom query to a report in the custom Watchlist.
From which page can the administrator add this custom query?
A security policy states to enable Live Response by default across the enterprise. However, the team identified critical systems which should not support Live Response due to risk. The team needs to disable Live Response on selected systems.
From which page can this goal be accomplished?
An analyst is investigating an alert within the Enterprise EDR console and needs to take action on it.
Which three actions are available to take on the alert? (Choose three.)
Which identifier is shared by all events when an alert is investigated?
Refer to the exhibit:
Which two logic statements correctly explain filtering within the UI? (Choose two.)
An analyst has investigated two alerts on two separate HR workstations and found that notepad.exe has
established communication to another IP address.
Which rule will kill notepad.exe entirely if this activity is detected in the future?
What is the maximum number of binaries (hashes) that can be banned using the web console?
An Enterprise EDR administrator is reviewing the Investigate page and believes they are receiving false positive hits from specific watchlist.
Which three options reduce future false positive hits from this watchlist? (Choose three.)
An administrator is creating a query per policy for Audit and Remediation. The administrator ran several
recommended queries already but notices they are unable to run the same recommended query for one of their policies. The run button is grayed out.
Which statement correctly explains why the run button is unavailable?
Review the following EDR query:
parent_name:outlook.exe AND -alliance_score_srstrust:* AND -digsig_result: "Signed'
Which process would show in the query results?