Broadcom Carbon Black Endpoint Detection and Response Technical Specialist (250-601) Certification Sample Questions

01. An administrator is setting expectations before a deployment moves to a cluster.
Which two things does clustering not change?
(Choose two.)
a) The set of features available to analysts
b) The number of machines that must be maintained
c) The search capacity available to the deployment
d) The volume of activity the deployment can hold
e) The way analysts work in a single console

02. In a clustered deployment, one node becomes unavailable. Searches still return, but analysts report that some older results seem to be missing.
What does this suggest?
a) The console is displaying a cached view of the results
b) The retention window has shortened during the outage
c) The unavailable node held part of the searchable data
d) The remaining nodes have rejected the older queries

03. A deployment's resource pressure has risen steadily over a year. The endpoint count has stayed the same throughout.
What best explains the increase?
a) The sensors have been upgraded to a newer release
b) The endpoints are generating more activity than before
c) The console has accumulated too many saved searches
d) The server's hardware has degraded over the year

04. What is the purpose of holding certain permissions separately from the ordinary role?
a) Some capabilities expire and must be granted again
b) Some capabilities are only available to administrators
c) Some capabilities require a separate sign-on method
d) Some capabilities carry more consequence than others

05. An analyst has opened a Live Response session and needs to establish what is executing on the endpoint at this moment.
Which of the basic capabilities does that?
a) Listing the processes currently running there
b) Reading the watchlist hits raised for that endpoint
c) Searching the recorded process history for it
d) Reviewing the sensor group the endpoint belongs to

06. Sensors are checking in normally and new activity is arriving, but analysts cannot get any search to return.
Which part of the server does this implicate?
a) The relational store holding accounts and settings
b) The Solr service that indexes and answers queries
c) The channel between the sensors and the server
d) The endpoints, which have stopped generating activity

07. A team installed the sensor into a golden image and sealed it without carrying out the preparation the product calls for. Desktops have already been cloned from it. What does putting this right involve?
a) Removing the affected desktops from their sensor group
b) Turning VDI support on and leaving the desktops be
c) Changing how clones are matched to what is known
d) Correcting the image and cloning the desktops again

08. Why is endpoint activity not lost while the server is down for maintenance?
a) Sensors hold what they collect until contact resumes
b) The endpoints send their activity to a standby server
c) Activity during maintenance is regenerated afterwards
d) The console records activity independently of the server

09. An organization runs a small number of virtual desktops that are built individually and kept for years, alongside its physical estate.
How should the VDI handling be judged?
a) It should be enabled in case the estate grows later
b) It is required for any virtualized endpoint, without exception
c) It addresses cloning, which this estate does not do
d) It applies only once the desktops become non-persistent

10. A team is considering extending how long data stays searchable.
Which two should they confirm first?
(Choose two.)
a) That the watchlists have been rewritten to match
b) That the longer window answers a real investigative need
c) That analysts have been trained on the older data
d) That every sensor supports the longer retention setting
e) That the storage can accommodate the additional data