Broadcom-VMware
5V0-91.20 · Question #46
An administrator observes the following event detail in the Investigate tab for an application with an unknown reputation making network connections: Process name: tutor.exe Process ID: 6720 App…
The correct answer is C. The application was UNKNOWN at the time of the event but then later determined to be NOT_LISTED. See the full explanation below for the reasoning.
Question
An administrator observes the following event detail in the Investigate tab for an application with an unknown reputation making network connections:
Process name: tutor.exe Process ID: 6720 App reputation: NOT_LISTED App reputation implied: (cloud) UNKNOWN App MD5: 03e047f26c57f202a0107297d0210 App SHA: 10f144d4224025a657 Event ID: 01f1057d251a4fdb3a979c6da8b Category: Monitored Alert ID: 01802cb Alert severity: 3 RTPs: INTERNATIONAL_SITE, NETWORK_ACCESS, ADAPTIVE_WHITE, APP_ACTIVE_CLIENT
Upon further review of the event details returned, the reputation is observed as NOT_LISTED, and the applied (cloud) reputation is UNKNOWN. Why is the applied (cloud) reputation UNKNOWN and not NOT_LISTED?
Options
- AThe sensor demoted the local reputation from UNKNOWN to NOT_LISTED based on the cloud reputation.
- BNOT_LISTED was applied by the sensor after observing no cloud reputation, as evidenced by the applied cloud reputation UNKNOWN.
- CThe application was UNKNOWN at the time of the event but then later determined to be NOT_LISTED.
- DThe sensor demoted the local reputation from NOT_LISTED to UNKNOWN based on the cloud reputation.
How the community answered
(33 responses)- A3% (1)
- B15% (5)
- C73% (24)
- D9% (3)
Community Discussion
No community discussion yet for this question.