Review this EDR query:

childproc_name:whoami.exe AND childproc_name:hostname.exe AND childproc_name:tasklist.exe AND childproc_name:ipconfig.exe

Which process would show in the query results?

A. Any process invoked by whoami.exe, hostname.exe, tasklist.exe, and ipconfig.exe

B. Any process invoked by whoami.exe, hostname.exe, tasklist.exe, or ipconfig.exe

C. Any process invoking whoami.exe, hostname.exe, tasklist.exe, or ipconfig.exe

D. Any process invoking whoami.exe, hostname.exe, tasklist.exe, and ipconfig.exe

An alert for a device running a proprietary application is tied to a vital business operation. Which action is appropriate to take?

A. Add the application to the Approved List.

B. Terminate the process.

C. Deny the operation.

D. Quarantine the device.

Which two statements are true about Carbon Black alerts? (Choose two.)

A. They can be grouped together.

B. Once received, it can be dismissed in bulk.

C. Once dismissed, the action cannot be undone.

D. Carbon Black does not generate alerts.

E. They are stored for 15 days.

An active compromise is detected on an endpoint. Due to current policies, the compromise was detected but not terminated.

What would be an appropriate action to end the current communication between the device and the attacker?

A. Uninstall the sensor

B. Place the system into bypass mode

C. Place the system into Quarantine D. Remotely scan the endpoint

Which statement should be used when constructing queries in Carbon Black Audit and Remediation, Live Query?

A. ALTER

B. UPDATE

C. REMOVE

D. SELECT