VMware 5V0-93.22 Exam - Topic 1 Question 13 Discussion

Actual exam question for VMware's 5V0-93.22 exam

Question #: 13
Topic #: 1

An administrator wants to prevent malicious code that has not been seen before from retrieving credentials from the Local Security Authority Subsystem Service, without causing otherwise good applications from being blocked.

Which rule should be used?

A[Unknown application] [Retrieves credentials] [Terminate process]

B[**/*.exe] [Scrapes memory of another process] [Terminate process]

C[**\lsass.exe] [Scrapes memory of another process] [Deny operation]

D[Not listed application] [Scrapes memory of another process] [Terminate process]

Show Suggested Answer

Suggested Answer: A, E, F

by Carey at Apr 20, 2024, 03:12 PM

Limited Time Offer

25%

Off

Get Premium 5V0-93.22 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jeffrey

3 months ago

B looks like it could catch a lot of bad stuff too.

upvoted 0 times

...

Felicitas

3 months ago

Wait, are we sure terminating processes is the right move?

upvoted 0 times

...

Shelia

3 months ago

C could be too restrictive, might block legit apps.

upvoted 0 times

...

Lai

4 months ago

I disagree, A seems more effective for unknown apps.

upvoted 0 times

...

Terina

4 months ago

I think option D is the best choice here.

upvoted 0 times

...

Marget

4 months ago

I lean towards option B because it mentions ".exe" files, which are common for applications, but I'm not confident if it would catch everything malicious.

upvoted 0 times

...

Alex

4 months ago

I'm a bit confused about the difference between "terminate process" and "deny operation." I feel like option C could be safer, but it might block legitimate apps too.

upvoted 0 times

...

Luann

4 months ago

I remember practicing a similar question, and I think option D might be more effective since it specifies "not listed application," which could cover more ground.

upvoted 0 times

...

Wilburn

5 months ago

I think option A sounds right since it targets unknown applications trying to retrieve credentials, but I'm not entirely sure if "terminate process" is the best action.

upvoted 0 times

...

Alyce

5 months ago

I'm pretty confident I know the right answer here. Option C looks like the best choice to meet the requirements of the question.

upvoted 0 times

...

Belen

5 months ago

Okay, I think I've got a strategy here. I'll focus on the rule that specifically targets the Local Security Authority Subsystem Service to prevent credential theft, while avoiding rules that might block legitimate applications.

upvoted 0 times

...

Michel

5 months ago

Hmm, I'm a bit confused by the wording here. I'll need to re-read the question a few times to make sure I understand it fully.

upvoted 0 times

...

Craig

5 months ago

This seems like a tricky one. I'll need to think carefully about the implications of each rule.

upvoted 0 times

...

Caprice

5 months ago

Okay, let me think this through step-by-step. I need to identify the key activities where measuring average cost per incident would be most important.

upvoted 0 times

...

Cordie

5 months ago

Okay, I think I've got this. First, I'll copy the `/etc/fstab` file to `/var/tmp` and make it executable for everyone. Then I'll use `setfacl` to grant read and write access to the user Tennie, and deny all access to the user Bernadine. Finally, I'll verify the permissions using `getfacl`.

upvoted 0 times

...

Cordell

5 months ago

I'm not so sure about that. Isn't prioritizing business focal points more related to option B? We did a similar question in practice.

upvoted 0 times

...

Lorean

10 months ago

Option B seems too broad. I don't want to risk shutting down every .exe file on the system. Let's go with the more targeted approach in Option C.

upvoted 0 times

Natalie

9 months ago

User 3: Option C it is then, we don't want to risk shutting down every .exe file on the system.

upvoted 0 times

...

Rosalind

9 months ago

User 2: Rosalind is right, let's go with the more targeted approach in Option C.

upvoted 0 times

...

Lou

9 months ago

User 1: I agree, Option B does seem too broad.

upvoted 0 times

...

Samira

10 months ago

Ha! I bet the person who wrote this question has a great sense of humor. 'Scrapes memory of another process' - that's a classic!

upvoted 0 times

Renea

9 months ago

C) [**\\lsass.exe] [Scrapes memory of another process] [Deny operation]

upvoted 0 times

...

Bobbye

9 months ago

Haha, yeah that does sound funny!

upvoted 0 times

...

Barb

9 months ago

A) [Unknown application] [Retrieves credentials] [Terminate process]

upvoted 0 times

...

Brianne

10 months ago

I'm not sure about that. Wouldn't terminating the process be a bit too harsh? Maybe we could try a less drastic approach first.

upvoted 0 times

Luisa

8 months ago

User 4: Denying the operation sounds like a more balanced approach to me.

upvoted 0 times

...

Avery

9 months ago

User 3: I agree, denying the operation could be a good first step to prevent malicious code.

upvoted 0 times

...

Arminda

9 months ago

User 2: That could be a good idea. Denying the operation might be less harsh.

upvoted 0 times

...

Tiara

9 months ago

User 1: Maybe we should try denying the operation instead of terminating the process.

upvoted 0 times

...

Gracia

11 months ago

Option C looks good to me. Denying the operation to lsass.exe seems like the best way to prevent the malicious code without blocking legitimate applications.

upvoted 0 times