Question 21

How long will Live Queries in Carbon Black Audit and Remediation run before timing out?
  • Question 22

    Which identifier is shared by all events when an alert is investigated?
  • Question 23

    An Enterprise EDR administrator is reviewing the Investigate page and believes they are receiving false positive hits from specific watchlist.
    Which three options reduce future false positive hits from this watchlist? (Choose three.)
  • Question 24

    An analyst has investigated multiple alerts on a number of HR workstations and found that java.exe is attempting to PowerShell. Of the Windows workstations in question, the analyst has also found that Java is installed in multiple locations. The analyst needs to block java.exe from this type of operation.
    Which rule meets this need?
  • Question 25

    What information does the Alert Details panel provide on the Alert Triage page in Endpoint Standard?