Valid 5V0-93.22 Dumps shared by ExamDiscuss.com for Helping Passing 5V0-93.22 Exam! ExamDiscuss.com now offer the newest 5V0-93.22 exam dumps, the ExamDiscuss.com 5V0-93.22 exam questions have been updated and answers have been corrected get the newest ExamDiscuss.com 5V0-93.22 dumps with Test Engine here:
An administrator wants to prevent malicious code that has not been seen before from retrieving credentials from the Local Security Authority Subsystem Service, without causing otherwise good applications from being blocked. Which rule should be used?
Correct Answer: D
Explanation This rule will prevent any application that is not listed in the Carbon Black Cloud Endpoint Standard from scraping the memory of another process, which is a common technique used by malware to retrieve credentials from the Local Security Authority Subsystem Service (LSASS). This rule will terminate the process that attempts to perform this operation, thus blocking the credential theft. This rule is more specific and effective than option A, which only applies to unknown applications, or option B, which applies to all executable files regardless of their reputation. Option C is incorrect because it will only deny the operation but not terminate the process, which may allow the malware to continue running and try other methods of credential theft. References: VMware Carbon Black Cloud Endpoint Standard Skills Reference Materials, Module 4: Endpoint Standard Rules, Lesson 2: Rule Types and Actions, slide 12.
