An administrator decides to migrate an SES Complete hybrid environment to a fully cloud-managed one. After cleaning up on-premise group structure and policies. What is the next recommended step for migration?

Export unique policies from SEPM

Migrate the agents from ICDm D Import unique policies in ICDm

The SES Intrusion Prevention System has blocked an intruder's attempt to establish an IRC connection inside the firewall. Which Advanced Firewall Protection setting should an administrator enable to prevent the intruder's system from communicating with the network after the IPS detection?

Automatically block an attacker's IP address

Block all traffic until the firewall starts and after the firewall stops

Enable denial of service detection

After several failed logon attempts, the Symantec Endpoint Protection Manager (SEPM) has locked the default admin account. An administrator needs to make system changes as soon as possible to address an outbreak, but the admin account is the only account.Which action should the administrator take to correct the problem with minimal impact on the existing environment?

Wait 15 minutes and attempt to log on again

Run the Management Server and Configuration Wizard to reconfigure the server

If an administrator enables the setting to manage policies from the cloud, what steps must be taken to reverse this process?

Unenroll the SEPM > Disable the setting > Re-enroll the SEPM

Navigate to ICDm > Enrollment and disable the setting

Unenroll the SEPM > Disable the setting > Re-enroll the SEPM

How would an administrator specify which remote consoles and servers have access to the management server?

Edit the Server Properties and under the General tab, change the Server Communication Permission.

Edit the Communication Settings for the Group under the Clients tab.

Edit the External Communication Settings for the Group under the Clients tab.

Edit the Site Properties and under the General tab, change the server priority.

An administrator notices that some entries list that the Risk was partially removed. The administrator needs to determine whether additional steps are necessary to remediate the threat.Where in the Symantec Endpoint Protection Manager console can the administrator find additional information on the risk?

Infected and At-Risk Computers report

Why is it important for an Incident Responder to copy malicious files to the SEDR file store or create an image of the infected system during the Recovery phase?

To document and preserve any pieces of evidence associated with the incident

To create custom IPS signatures

To test the effectiveness of the current assigned policy settings in the Symantec Endpoint Protection Manager (SEPM)

To have a copy of the file for policy enforcement

To document and preserve any pieces of evidence associated with the incident

An administrator changes the Virus and Spyware Protection policy for a specific group that disables Auto-Protect. The administrator assigns the policy and the client systems apply the corresponding policy serial number. Upon visual inspection of a physical client system, the policy serial number is correct. However, Auto-Protect is still enabled on the client system.Which action should the administrator take to ensure that the desired setting is in place for the client?

Enable the padlock next to the setting in the policy

Run a command on the computer to Update Content

Enable the padlock next to the setting in the policy

Withdraw the Virus and Spyware Protection policy

In the virus and Spyware Protection policy, an administrator sets the First action to Clean risk and sets If first action fails to Delete risk. Which two (2) factors should the administrator consider? (Select two.)

False positives may delete legitimate files.

A copy of the threat may still be in the quarantine.

The deleted file may still be in the Recycle Bin.

IT Analytics may keep a copy of the file for investigation.

False positives may delete legitimate files.

Insight may back up the file before sending it to Symantec.

A copy of the threat may still be in the quarantine.

Which Indicator of Compromise might be detected as variations in the behavior of privileged users that indicate that their account is being used by someone else to gain a foothold in an environment?

Irregularities in Privileged User Account Activity

Mismatched Port - Application Traffic

Irregularities in Privileged User Account Activity

Why is Active Directory a part of nearly every targeted attack?

AD exposes all of its identities, applications, and resources to every endpoint in the network

AD administration is managed by weak legacy APIs.

AD is, by design, an easily accessed flat file name space directory database

AD exposes all of its identities, applications, and resources to every endpoint in the network

AD user attribution includes hidden elevated admin privileges

What should an administrator know regarding the differences between a Domain and a Tenant in ICDm?

A tenant can contain multiple domains

Each customer can have one domain and many tenants

A domain can contain multiple tenants

Each customer can have one tenant and no domains

What should an administrator utilize to identify devices on a Mac?

Use GatherSymantecInfo when the Device is connected.

Use DevViewer when the Device is connected.

Use Devicelnfo when the Device is connected.

Use Device Manager when the Device is connected.

Use GatherSymantecInfo when the Device is connected.

What is an appropriate use of a file fingerprint list?

Allow unknown files to be downloaded with Insight

Prevent Antivirus from scanning a file

Allow files to bypass Intrusion Prevention detection

What is the purpose of a Threat Defense for Active Directory Deceptive Account?

It acts as a honeypot to expose attackers as they attempt to build their AD treasure map

It prevents attackers from reading the contents of the Domain Admins Group.

It assigns a fake NTLM password hash value for users with an assigned AdminCount attribute.

It exposes attackers as they seek to gather credential information from workstation memory.

It acts as a honeypot to expose attackers as they attempt to build their AD treasure map

How does IPS check custom signatures?

IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine stops checking other signatures.

IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine continues checking for other signatures.

IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine restarts checking for signatures.

IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine stops checking other signatures.

IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine logs the other signatures.

An Application Control policy includes an Allowed list and a Blocked list. A user wants to use an application that is neither on the Allowed list nor on the Blocked list. What can the user do to gain access to the application?

Wait for the Application Drift process to complete

What does an end-user receive when an administrator utilizes the Invite User feature to distribute the SES client?

An email with a link to directly download the SES client

An email with the SES_setup.zip file attached

An email with a link to register on the ICDm user portal

An email with a link to directly download the SES client

An email with a link to a KB article explaining how to install the SES Agent

An organization identifies a threat in its environment and needs to limit the spread of the threat. How should the SEP Administrator block the threat using Application and Device Control?

Gather the MD5 hash of the file and create an Application Content Rule that blocks the file based on the file fingerprint.

Gather the process name of the file and create an Application Content Rule that blocks the file based on the device ID type.

Gather the MD5 hash of the file and create an Application Content Rule that uses regular expression matching.

Gather the MD5 hash of the file and create an Application Content Rule that blocks the file based on specific arguments.

Broadcom 250-580 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

A Symantec Endpoint Protection (SEP) administrator receives multiple reports that machines are experiencing performance issues. The administrator discovers that the reports happen at about the same time as the scheduled LiveUpdate.

Which setting should the SEP administrator configure to minimize I/O when LiveUpdate occurs?

Change the LiveUpdate schedule

Change the Administrator-defined scan schedule

Disable Allow user-defined scans to run when the scan author is logged off

Disable Run an Active Scan when new definitions arrive

Comment (0)

Broadcom 250-580 Practice Test 1

Question

Broadcom 250-580 Practice Tests

Practice Tests