Question 21
How long will Live Queries in Carbon Black Audit and Remediation run before timing out?
Question 22
Which identifier is shared by all events when an alert is investigated?
Question 23
An Enterprise EDR administrator is reviewing the Investigate page and believes they are receiving false positive hits from specific watchlist.
Which three options reduce future false positive hits from this watchlist? (Choose three.)
Which three options reduce future false positive hits from this watchlist? (Choose three.)
Question 24
An analyst has investigated multiple alerts on a number of HR workstations and found that java.exe is attempting to PowerShell. Of the Windows workstations in question, the analyst has also found that Java is installed in multiple locations. The analyst needs to block java.exe from this type of operation.
Which rule meets this need?
Which rule meets this need?
Question 25
What information does the Alert Details panel provide on the Alert Triage page in Endpoint Standard?
