An administrator needs to check configurations using Audit across several policies and locations within the organization.
How can the administrator run the query to only these specific devices?

• A. Specify the policy for the endpoints on the query, and then type the sensor name into the text box, selecting the devices. Repeat as necessary for all devices.
• B. Specify the policy for the endpoints on the query, and then select the check box for each device.
• C. Specify endpoints on the query by selecting the check box for each device.
• D. Specify endpoints on the query by typing the sensor name into the text box, selecting the device. Repeat as necessary for all devices.

An analyst wants to block an application's specific behavior but does not want to kill the process entirely as it is heavily used on workstations. The analyst needs to use a Blocking and Isolation Action to ensure that the process is kept alive while blocking further unwanted activity.
Which Blocking and Isolation Action should the analyst use to accomplish this goal?

• A. Log Operation
• B. Deny Operation
• C. Terminate Process
• D. Block Process

Which statement is true about configuring VMware Carbon Black Application Control for use on non-persistent virtual machines (VM's)?

• A. The gold image housing the agent template must be digitally signed to ensure the integrity of the agent cache.
• B. The endpoint housing the agent template must always be off except when updating the image.
• C. The agent running on the template machine must not be initialized before deploying clones.
• D. The endpoint housing the agent template must always be on/running except when updating the image.

Given an event rule: Approve nVidia Drivers, changes the local state to Approved for file writes or execution blocks when the publisher is NVIDIA Corporation.
How is an alert created that is triggered whenever an nVidia driver is approved by the event rule?

• A. Create a custom rule name Approve nVidia that approves writes or blocks when the publisher is NVIDIA Corporation. Create an alert for rule name Approve nVidia. Click Create and add email recipients.
• B. Click Create Alert on the event rule Approve nVidia Drivers details page. Add email recipients. Create and Exit.
• C. Add a new Alert of type Event Alert. Set Subtype to New unapproved file to computer and Execution block (unapproved file) and Publisher to NVIDIA Corporation. Click Create and add email recipients.
• D. Click Create Alert on the event rule Approve nVidia Drivers details page. Click Create and add email recipients. Create and Exit.

An incorrectly constructed watchlist generates 10,000 incorrect alerts.
How should an administrator resolve this issue?

• A. Delete the watchlist to automatically clear the alerts, and then create a new watchlist with the correct criteria.
• B. From the Triage Alerts Page, use the facets to select the watchlist, click the Wrench button to "Mark all as Resolved False Positive", and then update the watchlist with the correct criteria.
• C. Update the Triage Alerts Page to show 200 alerts, click the Select All Checkbox, click the "Dismiss Alert(s)" button for each page, and then update the watchlist with the correct criteria.
• D. From the Watchlists Page, select the offending watchlist, click "Clear Alerts" from the Action menu, and then update the watchlist with the correct criteria.