Broadcom Carbon Black Cloud Technical Specialist (250-602) Certification Sample Questions

01. An alert fires on a workstation at an airline operations center, and the analyst opens the recorded events to look for related activity.
How should the analyst set the time range of that first search?
a) Search the whole span of retained data from the start and narrow it down once results arrive
b) Start with a window around the alert, then widen it as the evidence calls for
c) Search only the activity recorded after the alert fired
d) Start at the moment the alert fired, then widen the range forward as later events come in

02. A retail pharmacy chain finds that an employee's workstation was used to copy prescription records to a personal cloud storage account. HR and legal counsel may take action against the employee.
Which two steps should the security team take before remediating the workstation?
(Choose two.)
a) Send HR a summary of conclusions and discard the working notes behind it
b) Reimage the workstation now and rebuild the timeline from recorded events later
c) Remove the related alerts from the console until HR reaches its decision
d) Record each search run, what it returned and the time it was run
e) Hold off wiping or reimaging the workstation until the scope is established

03. On the same morning, an analyst reviews two detections of a program that had not been seen before on the machine it ran on. One came from a database server that hosts a single application. The other came from a sales representative's laptop.
How should the analyst weigh the two detections?
a) Treat both detections as equally suspicious and give them the same priority in the review queue
b) Investigate the laptop detection first and close the server detection as routine maintenance
c) Treat the server detection as the stronger signal and investigate it
d) Set both detections aside until the program turns up on several more machines in the company

04. A video game studio runs its build servers as VMs under vCenter and its matchmaking servers as native instances in a public cloud, with no vCenter involved. The Workload inventory lists every build server but none of the matchmaking instances.
What should the team do to bring the matchmaking instances under protection?
a) Install the sensor directly on each cloud instance, and it appears once its sensor starts reporting
b) Add the cloud instances to vCenter as hosts and let the appliance discover them
c) Deploy a second Workload appliance in the cloud network next to the instances
d) Wait for the next inventory refresh, which will list the matchmaking instances

05. A regional clinic's technician needs a sensor installer for a new front-desk computer. A colleague offers to forward an installer by email, and a web search turns up a download on a software-sharing site.
Where should the technician get the installer?
a) From the colleague's email, once the colleague confirms having sent the message
b) From the sharing site, if the file name matches the copy in the colleague's email
c) From whichever of the two copies installs cleanly on a test computer first
d) From the clinic's own Carbon Black Cloud console

06. An analyst reviews an alert about a script running on a workstation, decides the activity needs no further attention, and dismisses the alert.
What has dismissing the alert changed?
a) It recorded the analyst's triage decision
b) It stopped the script that was running on the workstation
c) It added the script to the workstation's policy as an allowed application
d) It removed the alert and its activity details from the console

07. A server is suspected of running malware that hides its own files and processes from the operating system. A Live Query for the attacker's process reaches that server, which responds with no match.
How much weight should the team give that clean result?
a) Full weight, as the query reads the disk and memory directly instead of through the operating system
b) Enough to close the case, provided the same query also returns clean on the neighboring servers
c) Little, as the query sees what the compromised operating system reports
d) Little, as the server may have gone offline before it could answer the query

08. A law firm's IT group adds an exception to the policy that the litigation team's endpoints are assigned to, so the team can run a document-conversion utility during a large case. The case is expected to close next quarter.
What should the IT group do about the exception?
a) Extend it to every team at the firm that uses the document-conversion utility
b) Set a review date and remove it when the case closes
c) Replace it by moving the litigation team's endpoints into a policy of their own
d) Keep it in place after the case closes and record it in the policy notes

09. Analysts at a research institute are watching an intruder who has access to a server holding unpublished trial data. The team wants to keep observing to learn the intruder's tools and other footholds, and has just seen the intruder begin compressing files from the research data share.
What should the team do now?
a) Keep observing until every foothold is mapped, then contain all of them together in one coordinated action
b) Wait for the intruder to begin transferring files out, then contain the server with proof of exfiltration
c) Keep observing and add the compression tool's hash to a watchlist for further tracking
d) Contain the intrusion now, accepting the loss of further observation

10. A county government needs to approve a permit-management application whose vendor releases updates often. The administrator is comparing an approval based on the vendor's signing certificate with one based on the application's file hash.
Which statements about this trade-off are accurate?
(Choose two.)
a) An approval by signing certificate keeps covering the application as the vendor releases new signed versions
b) An approval by file hash also trusts other files the vendor builds and signs with its certificate
c) An approval by signing certificate also trusts other software the vendor signs with the same certificate
d) An approval by file hash keeps covering the application as the vendor releases new versions
e) An approval by signing certificate applies only to the single computer where the application was approved