Question 36

How is a new Alert of type Event Alert created whenever an endpoint is added or deleted and send emails for the App Control admin whenever these events occur?
  • Question 37

    An administrator wants to find instances where the binary Is unsigned.
    Which term will accomplish this search?
  • Question 38

    An administrator needs to query all endpoints in the HR group for instances of an obfuscated copy of cmd.exe.
    Given this Enterprise EDR query:
    process_name:cmd.exe AND device_group:HR AND NOT enriched:true
    Which example could be added to the query to provide the desired results?
  • Question 39

    At which three frequencies may a Carbon Black Audit and Remediation administrator schedule the run of Live Queries? (Choose three.)
  • Question 40

    Which Live Query statement is properly constructed?