Free Practice Questions for the VMware Carbon Black Cloud Endpoint Standard Skills 2023 5V0-93.22 Exam (2026 Updated)

According to the VMware Carbon Black Cloud Sensor Installation Guide, the permission level that is required when a user wants to install a sensor on a Windows endpoint is Administrator. The user must have local administrator privileges on the endpoint to install the sensor. The user can install the sensor by using one of the following methods:

Method 1: Invite Users to Install Sensors on Endpoints: This method allows the user to install the sensor by using an installation code that is sent by email from the Carbon Black Cloud console. The user must run the installation code as an administrator on the endpoint.

Method 2: Install the Sensor on the Endpoint by using the Command Line or Software Distribution Tools: This method allows the user to install the sensor by using the command line, or by using a scripted or automated method such as Group Policy or systems management tools. The user must run the installation command or script as an administrator on the endpoint.

The other permission levels are not sufficient or relevant for installing a sensor on a Windows endpoint. Everyone is a group that includes all users and groups on the endpoint, but it does not grant administrator privileges. Root is a user that has full access and control over a Linux or Unix system, but it is not applicable to a Windows endpoint. User is a general term that refers to any person who uses a computer or network service, but it does not imply administrator privileges.  References :

VMware Carbon Black Cloud Sensor Installation Guide , page 7, Sensor Components section, Sensor Service (RepMqr) subsection.

Installing Windows Sensors on Endpoints - VMware Docs , Procedure section, step 1.

 A Watchlist is a collection of queries that run against the data in the VMware Carbon Black Cloud Endpoint Standard. Watchlists enable administrators to monitor the activity of endpoints for specific Tactics, Techniques, or Procedures (TTPs) that are of interest. Administrators can configure alerts for Watchlist hits, which will notify them when a particular TTP is observed on a managed endpoint. Alerts for Watchlist hits can be sent via email, syslog, or webhook.  References :

VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Module 3: Threat Hunting, Lesson 3.2: Watchlists, page 3-10

VMware Carbon Black Cloud Endpoint Standard User Guide, Chapter 7: Watchlists, page 115-116

The best way to proactively know that something may get blocked when putting a policy rule in the environment is to search the data using the test rule functionality in the VMware Carbon Black Cloud Endpoint Standard console. The test rule functionality allows the administrator to test a new rule’s settings before applying it in the environment. The system checks to see how the rule would have affected the organization over the last 30 days and displays the number of devices and events that would have been impacted by the rule. The administrator can use this data to confirm or modify the settings and avoid unnecessary blocks or false positives.  The test rule functionality is available for both permission rules and blocking and isolation rules 1 2 .

The other options are not recommended or feasible for obtaining this information. Examining log files to see what would be impacted is not a reliable or efficient method, as it would require manually reviewing a large amount of data and correlating it with the rule settings. Putting the rules in and seeing what happens to the endpoints is a risky and reactive approach, as it could cause disruption or damage to the endpoints and the network. Determining what would happen based on previously used antivirus software is not a valid or accurate method, as different antivirus software may have different detection and prevention capabilities and configurations.  References :

Set Permission Policy Rules - VMware Docs , Procedure section, step 7.

Set Blocking and Isolation Policy Rules - VMware Docs , Procedure section, step 7.

 The Investigate page in the VMware Carbon Black Cloud Endpoint Standard console is where the security administrator can perform a search to further inspect the script-based attack that was coded into Excel VBA. The Investigate page allows the administrator to use advanced search techniques to query the endpoint data collected by the VMware Carbon Black Cloud sensors. The administrator can use various fields and operators to filter and refine the search results, such as process_name, file_name, file_path, file_type, file_description, and more. The administrator can also use the process tree view to visualize the process execution and the event details to examine the process activity. For example, the administrator can use the following search query to find all the processes that have a file type of Excel VBA:

file_type:EXCEL_VBA

This query will return all the processes that have a file type of EXCEL_VBA, which is a file type that indicates the file contains Excel VBA code. The file_type field is a string that indicates the type of the file based on its content and format. The possible values for this field are:

EXE: Executable file

DLL: Dynamic-link library file

SYS: System file

BAT: Batch file

CMD: Command file

VBS: Visual Basic Script file

JS: JavaScript file

PS1: PowerShell Script file

HTA: HTML Application file

MSI: Windows Installer file

DOC: Microsoft Word document file

XLS: Microsoft Excel spreadsheet file

PPT: Microsoft PowerPoint presentation file

PDF: Portable Document Format file

SWF: Shockwave Flash file

JAR: Java Archive file

CLASS: Java class file

PY: Python script file

SH: Shell script file

PL: Perl script file

RB: Ruby script file

PHP: PHP script file

ASP: Active Server Pages file

ASPX: Active Server Pages Extended file

HTML: HyperText Markup Language file

XML: Extensible Markup Language file

DOCM: Microsoft Word document with macros file

XLAM: Microsoft Excel add-in with macros file

XLSM: Microsoft Excel spreadsheet with macros file

XLTM: Microsoft Excel template with macros file

PPTM: Microsoft PowerPoint presentation with macros file

POTM: Microsoft PowerPoint template with macros file

PPAM: Microsoft PowerPoint add-in with macros file

EXCEL_VBA: Excel Visual Basic for Applications file

WORD_VBA: Word Visual Basic for Applications file

POWERPOINT_VBA: PowerPoint Visual Basic for Applications file

OUTLOOK_VBA: Outlook Visual Basic for Applications file

ACCESS_VBA: Access Visual Basic for Applications file

PROJECT_VBA: Project Visual Basic for Applications file

VISIO_VBA: Visio Visual Basic for Applications file

PUBLISHER_VBA: Publisher Visual Basic for Applications file

INFOPATH_VBA: InfoPath Visual Basic for Applications file

ONENOTE_VBA: OneNote Visual Basic for Applications file

UNKNOWN: Unknown file type

Therefore, by using the Investigate page in the VMware Carbon Black Cloud Endpoint Standard console, the security administrator can perform a search to further inspect the script-based attack that was coded into Excel VBA.  References :

Investigate Endpoint Data - VMware Docs , Overview section.

Advanced Search Techniques - VMware Docs , Using Fields section, file_type subsection.

The pre-requisite step in gathering specific vulnerability data to export it as a CSV file for analysis is A. Perform a custom search on the Endpoint Page. This step allows the security administrator to use advanced search techniques to query the endpoint data collected by the VMware Carbon Black Cloud sensors. The administrator can use various fields and operators to filter and refine the search results, such as process_name, file_name, file_path, file_type, file_description, and more. The administrator can also use the process tree view to visualize the process execution and the event details to examine the process activity. After performing the custom search, the administrator can export the data as a CSV file for further analysis by clicking the Export () icon and selecting CSV Report.  The CSV file is available for download under the Notifications drop-down menu 1 .

The other options are not pre-requisite steps in gathering specific vulnerability data to export it as a CSV file for analysis. Accessing the Audit Log content to see associated events is a step that allows the administrator to review actions performed by Carbon Black Cloud console users, such as logging in, creating policies, banning hashes, isolating devices, and initiating Live Response sessions.  The Audit Log does not provide specific vulnerability data for the endpoints 2 . Searching for specific malware by hash or filename is a step that allows the administrator to find and analyze malicious files on the endpoints, but it does not provide comprehensive vulnerability data for the endpoints.  Enabling cloud analysis is a step that allows the administrator to upload file metadata and content to the Carbon Black Cloud for reputation and threat intelligence analysis, but it does not provide specific vulnerability data for the endpoints 3 .  References :

Investigate Endpoint Data - VMware Docs , Overview section.

Audit Logs - VMware Docs , Overview section.

Cloud Analysis - VMware Docs , Overview section.

Event data is categorized and identified by a unique event ID in VMware Carbon Black Cloud. The sensor will upload all event data to the Investigate page of the Endpoint Standard Console. This includes but is not limited to all failed and successful operations which happen at the machine level as well as any operations which are blocked or terminated by the sensor. Each event sent from the sensor to the Dashboard will be assigned a unique event ID.  References : Endpoint Standard: How is event data categorized, and formed into an Alert 1

 The operation attempt that must use a Terminate Process action is Scrapes memory of another process. This is a policy rule in VMware Carbon Black Cloud Endpoint Standard that blocks and terminates any process that attempts to read the memory of another process. This is a common technique used by malware to steal sensitive information, such as passwords, encryption keys, or tokens, from legitimate applications. By using a Terminate Process action, the policy rule ensures that the malicious process is stopped and removed from the endpoint, preventing further damage or data exfiltration. The other operation attempts do not require a Terminate Process action, but they can use other actions, such as Alert, Deny, or Isolate Device, depending on the policy configuration and the security needs of the organization.  References :  Carbon Black Cloud Endpoint Standard - Technical Overview ,  Best Practices: Endpoint Standard Blocking & Isolation Rules ,  Endpoint Standard: Deny/Terminate action taken on an Allowed Application

To create a search that excludes “system.exe”, the administrator needs to use the  minus sign (-)  as a  negation operator  in the search query. The negation operator excludes any events that match the specified field and value from the search results. For example, the query  -process_name:system.exe  will return all the events that do not have “system.exe” as the process name. The other options are incorrect because they do not use the negation operator. The  hash sign (#)  is used to search for exact matches, the  asterisk (*)  is used as a wildcard character, and the  angle brackets ( <</b> > )  are used to search for ranges of values.  References :

VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Module 2: Search, pages 2-5 to 2-6.

VMware Carbon Black Cloud Endpoint Standard User Guide, Chapter 7: Search, pages 83-84.