5V0-93-22 Carbon Black Cloud Endpoint Standard Skills Practice Questions

Carbon Black Cloud rules can target not only the process name but also specific command-line arguments. Creating a process blocking rule for bitsadmin.exe and adding the condition that the command line must contain --exploit-now provides the necessary precision. This blocks the malicious usage while allowing all other legitimate executions of bitsadmin.exe to proceed.

This is true. Carbon Black Cloud policies are designed to be cross-platform. A single policy contains sections for Windows, macOS, and Linux, allowing an administrator to define platform-specific prevention rules and sensor settings within one consolidated policy. This simplifies management in heterogeneous environments.

The Event Forwarder is the designated feature for sending event and alert data to an external SIEM. It securely pushes data to an AWS S3 bucket, from which the SIEM can then collect it. This provides a scalable and reliable method for data integration. API Access levels and keys are required to set it up, but the feature itself is the Event Forwarder.

The best approach is precise tuning. Creating specific permission rules that allow the tools to run when executed from a specific path or signed by a trusted publisher reduces noise for legitimate use. Additionally, if the alerts are from a watchlist, tuning the watchlist query (e.g., to exclude executions by known IT admin accounts) can significantly reduce false positives. Globally approving the hash could be risky if the tool is ever compromised. Disabling prevention rules weakens security.

The diagram and standard architecture show that the sensor always initiates the communication. It establishes a secure, persistent outbound connection to the Carbon Black Cloud backend over TCP port 443. This connection is bidirectional in nature, allowing the sensor to stream event data to the cloud and the cloud to push down policy updates, commands, and other instructions without requiring any inbound firewall rules.

Setting Carbon Black Intelligence (Cloud) reputation to the highest priority ensures that known malware and suspicious files identified by VMware's threat intelligence are blocked first. This provides the core security requirement. Since the internal tools are unsigned, prioritizing Company Approved (Signed) would not help and could be complex to manage. Prioritizing IT Tools or ignoring reputation would weaken the security posture unacceptably.

The correct syntax to exclude a value in a Carbon Black Cloud search query is to prefix the field with a hyphen (-). This query correctly filters for events where the process name is svchost.exe and excludes any events where the network connection domain is corp.local. The NOT operator is not used in this manner for field value exclusion.

A Sensor Operation Exclusion is designed specifically for performance tuning. It instructs the sensor to ignore file, script, and network operations for a specified path or certificate, which directly addresses the high CPU caused by monitoring frequent, benign write operations. Event Reporting Exclusions only stop events from being sent to the cloud, but the sensor still processes them locally. Adding a permission rule doesn't stop the sensor from monitoring the activity, and placing the sensor in bypass mode is a significant security risk.

The correct sequence is to first change the current directory to the location of the file using cd %temp%, and then use the get command to retrieve the file from the endpoint to the Carbon Black Cloud. The pull command does not exist. Executing get with the full path is also a valid method, but the cd command is commonly used to simplify paths. The memget command is for retrieving process memory, not files.

In Carbon Black Cloud's prevention logic, if the interpreter (powershell.exe in this case) is explicitly blocked, any scripts that rely on that interpreter will also be blocked, regardless of permissions on the script file itself. The block on the parent process (powershell.exe) is enforced before the script is even processed.