VMware Carbon Black Portfolio Skills

Here you have the best VMware 5V0-91.20 practice exam questions

You have 56 total questions to study from
Each page has 5 questions, making a total of 12 pages
You can navigate through the pages using the buttons at the bottom
This questions were last updated on October 25, 2025
This site is not affiliated with or endorsed by VMware.

Question 1 of 56

An analyst has investigated two alerts on two separate HR workstations and found that notepad.exe has established communication to another IP address.
Which rule will kill notepad.exe entirely if this activity is detected in the future?

**\system32\notepad.exe --> Communicates over the network --> Terminate process

**\system32\notepad.exe --> Runs or is Running --> Deny operation

**/system32/notepad.exe --> Runs or is Running --> Terminate process

**/system32/notepad.exe--> Communicates over the network --> Deny operation

Correct Answer: C

Question 2 of 56

A Carbon Black administrator received an alert for an untrusted hash executing in the environment.
Which two information items are found in the alert pane? (Choose two.)

Launch Live Query

Launch process analysis

User quarantine

Add hash to banned list

IOC short name

Correct Answer: A, B

Question 3 of 56

An administrator observes the following event detail in the Investigate tab for an application with an unknown reputation making network connections:
Exam 5V0-91.20: Question 3 - Image 1

Upon further review of the event details returned, the reputation is observed as NOT_LISTED, and the applied (cloud) reputation is UNKNOWN.
Why is the applied (cloud) reputation UNKNOWN and not NOT_LISTED?

The sensor demoted the local reputation from UNKNOWN to NOT_LISTED based on the coud reputation.

NOT_LISTED was applied by the sensor after observing no cloud reputation, as evidenced by the applied cloud reputation UNKNOWN.

The application was UNKNOWN at the time of the event but then later determined to be NOT_LISTED.

The sensor demoted the local reputation from NOT_LISTED to UNKNOWN based on the cloud reputation.

Correct Answer: C

Question 4 of 56

In which two ways can the tamper protection on an App Control agent be disabled when diagnosing agent issues or removing the agent? (Choose two.)

From the Computer Details page on the web console

From the Files on Computers page on the web console

Run authenticated DasCLI on Windows command prompt

Run RepCLI on Windows command prompt

From the File Catalog page on the web console

Correct Answer: A, C

Question 5 of 56

Which Sensor Status under Endpoint Health indicates that a system's policy enforcement is disabled, and the sensor is not sending security event data to the cloud?

Quarantined

Deregistered

Inactive

Bypass

Correct Answer: D