Broadcom-VMware
5V0-91.20 · Question #116
An Enterprise EDR administrator is reviewing the Investigate page and believes they are receiving false positive hits from specific watchlist. Which three options reduce future false positive hits…
The correct answer is A. Disable/remove the IOC associated with the false positives. B. Disable/remove the report associated with the false positives. D. Select edit watchlist and uncheck alert on hits. See the full explanation below for the reasoning.
Question
An Enterprise EDR administrator is reviewing the Investigate page and believes they are receiving false positive hits from specific watchlist.
Which three options reduce future false positive hits from this watchlist? (Choose three.)
Options
- ADisable/remove the IOC associated with the false positives.
- BDisable/remove the report associated with the false positives.
- CDismiss the watchlist hit.
- DSelect edit watchlist and uncheck alert on hits.
- EModify policy rules to exclude the false positive directory.
- FDisable the watchlist associated with the false positives.
How the community answered
(66 responses)- A85% (56)
- C9% (6)
- E5% (3)
- F2% (1)
Community Discussion
No community discussion yet for this question.