TM-VISIONONE Practice Test

TM-VISIONONE practice test: what's covered

• Trend Vision One
• XDR
• Workbench
• OAT
• ASRM
• Threat Hunting

Free TM-VISIONONE sample questions

1. Trend Vision One is BEST described as:

   • A. An on-prem antivirus console only
   • B. A cloud-native, unified cybersecurity platform that ingests telemetry from endpoint, email, network, cloud, and identity sensors to deliver XDR detection, response, and attack-surface risk management
   • C. A backup-and-restore appliance
   • D. A standalone firewall OS
   Show answer

   Correct: B. Vision One is SaaS XDR. It correlates cross-layer telemetry (endpoint/email/network/cloud/identity) into a single detection-and-response surface. Apex One / Cloud One feed it; it is not itself an on-prem AV or a firewall.

2. A new tenant must onboard 500 Windows endpoints into Vision One XDR. The correct mechanism is:

   • A. Manually install a standalone AV on each
   • B. Deploy the Trend Micro Endpoint sensor (via the Endpoint Inventory / Service Gateway agent package or upgrade existing Apex One agents) so each endpoint streams Activity Data to the Data Lake
   • C. Open a firewall port to each endpoint
   • D. Use BGP to advertise the endpoints
   Show answer

   Correct: B. XDR depends on the endpoint sensor sending Activity Data (process/file/registry/network telemetry) to the cloud Data Lake. Apex One agents can be upgraded to the XDR sensor. Without the sensor, an endpoint is invisible to Workbench.

3. The Service Gateway in a Vision One deployment is used to:

   • A. Run BGP
   • B. Provide a local appliance/VM for on-prem connectivity — proxying agent comms, hosting local Smart Protection / suspicious-object sync, and reducing direct-internet egress for sensors
   • C. Replace the endpoint agent
   • D. Store all logs forever locally
   Show answer

   Correct: B. Service Gateway is the on-prem bridge — forward proxy for agents, local cache for threat intel / suspicious-object lists, and integration point for products that can't reach the cloud directly. Helps in air-gapped-ish networks.

4. Which TWO telemetry layers can Vision One correlate in a single Workbench alert? (Choose 2)

   • A. Endpoint activity (process tree, file, network)
   • B. Email (Cloud App Security / ServerProtect mail flow)
   • C. Printer toner levels
   • D. BIOS POST codes
   Show answer

   Correct: A and B. XDR's value is cross-layer correlation: a phishing email (email sensor) → malicious attachment execution (endpoint sensor) → C2 callback (network sensor) stitched into one incident. Printer/BIOS are not data sources.

5. "Activity Data" retention in the Vision One Data Lake by default is approximately:

   • A. Forever at no cost
   • B. A finite window (commonly ~30 days for endpoint Activity Data, extendable with additional data-retention add-ons) — older data ages out of hot search
   • C. 24 hours only
   • D. Stored on the endpoint, never in the cloud
   Show answer

   Correct: B. Hot Activity Data has a default retention (~30 days endpoint). Longer retention requires the data-retention add-on or Logpush to a SIEM / data lake for cold storage. Plan hunting windows around this limit.

Last updated: 2026-10-19

TM-VISIONONE practice test FAQ