After an emergency, what does the Restore computer button do on the App Control Home page?

Refer to the exhibit:

Which two statements are true about Carbon Black Live Response (CBLR)? (Choose two.)

A process wrote an executable file as detailed in the following event:

Which rule type should be used to ensure that files of the same name and path, written by that process in the future, will not be blocked when they execute?

An administrator is creating a query per policy for Audit and Remediation. The administrator ran several recommended queries already but notices they are unable to run the same recommended query for one of their policies. The run button is grayed out.
Which statement correctly explains why the run button is unavailable?

An administrator is concerned that someone may be using unauthorized commands from cmd.exe. These commands are not considered suspicious or malicious, and there is no policy based around them.
Which page should the administrator use to find these commands?