A courts e-filing desktop app is terminated by Carbon Black Cloud. SOC confirms the policy’s core prevention is working as designed against unknown binaries. What should the security administrator do?
Select an answer to reveal the explanation.
Short Explanation
The guard is doing the job — the clerk's known stamp just needs a name badge. Add a scoped permission for that e-filing app instead of firing the guard or opening every door.
Full Explanation
When Carbon Black Cloud core prevention terminates a known line-of-business binary, the correct tune is a scoped application permission in that sensor policy. Uninstalling the sensor or leaving an OU in bypass removes protection rather than fixing the false positive. An NSX-T any-any rule does not stop host-level termination of the process.