The Security Status on the console home page is failing to alert a Symantec Endpoint Protection (SEP) administrator when virus definitions are out of date.How should the SEP administrator enable the Security Status alert?

Lower the Security Status thresholds

Raise the Security Status thresholds

Change the Notifications setting to 'Show all notifications'

Change the Action Summary display to 'By number of computers'

Which type of communication is blocked, when isolating the endpoint by clicking on the isolate button in SEDR?

All non-SEP and non-SEDR network communications

Only SEP and SEDR network communications

Only Web and UNC network communications

What does SONAR use to reduce false positives?

Extended File Attributes (EFA) table

What characterizes an emerging threat in comparison to the traditional threat?

Emerging threats use new techniques and 0-day vulnerability to propagate.

Emerging threats are more sophisticated than traditional threats.

Emerging threats require artificial intelligence to be detected.

Emerging threats are undetectable by signature-based engines.

Emerging threats use new techniques and 0-day vulnerability to propagate.

Which statement demonstrates how Symantec EDR hunts and detects IoCs in the environment?

Searching the EDR database and multiple data sources directly

Detecting Memory Exploits in conjunction with SEP

Detonating suspicious files using cloud-based or on-premises sandboxing

Which two (2) instances could cause Symantec Endpoint Protection to be unable to remediate a file? (Select two.)

There are insufficient file permissions.

The file is marked for deletion by Windows on restart.

Which action can an administrator take to improve the Symantec Endpoint Protection Manager (SEPM) dashboard performance and report accuracy?

Decreasing the number of content revisions to keep

Lowering the client installation log entries

Limiting the number of backups to keep

In what order should an administrator configure the integration between SEDR and Symantec Endpoint Protection in order to maximize their benefits?

ECC, Synapse, then Insight Proxy

Synapse, ECC, then Insight Proxy

ECC, Synapse, then Insight Proxy

Insight Proxy, Synapse, then ECC

ECC, Insight Proxy, then Synapse

How does an administrator view all devices impacted by a suspicious file?

From the Discovered Items list, select the file; then, from the Details page, select Devices.

From the Alerts and Events list, select Files; then, from the file list, select Devices.

From the Discovered Items list, select Devices.

From the Discovered Items list, select the file; then, from the Details page, select Devices.

From the Alerts and Event list, select Device.

A company deploys Symantec Endpoint Protection (SEP) to 50 virtual machines running on a single ESXi host.Which configuration change can the administrator make to minimize sudden IOPS impact on the ESXi server while each SEP endpoint communicates with the Symantec Endpoint Protection Manager?

Increase the download randomization window

Increase the download Insight sensitivity level

Increase the download randomization window

Reduce the number of content revisions to keep

SES includes an advanced policy versioning system. When an administrator edits and saves the properties of an existing policy, a new version of the policy is created. What is the status of all previous versions of the policy?

They are added to the policy archive list

They are marked dormant until reactivated

They are active and can be assigned

They are added to the policy archive list

Why is it important for an Incident Responder to review Related Incidents and Events when analyzing an incident for an After Actions Report?

It ensures that the Incident is resolved, and the responder can determine the best remediation method.

It ensures that the Incident is resolved, and the threat does not continue to spread to other parts of the environment.

It ensures that the Incident is resolved, and future threats are automatically remediated.

It ensures that the Incident is resolved, and the responder is able to close the incident in the SEDR manager.

It ensures that the Incident is resolved, and the responder can determine the best remediation method.

Which action is provided by Symantec EDR for the rapid remediation of impacted endpoints?

Block Listing or Allow Listing of specific files

Quickly filtering for specific attributes

Detonate Memory Exploits in conjunction with SEP

Automatically stopping suspicious behaviors & unknown threats

Block Listing or Allow Listing of specific files

Which action does SONAR take before convicting a process?

Checks the reputation of the process

A company allows users to create firewall rules. During the course of business, users are accidentally adding rules that block a custom internal application.Which steps should the Symantec Endpoint Protection administrator take to prevent users from blocking the custom application?

Create an Allow Firewall rule for the application and place it at the bottom of the firewall rules above the blue line

Create an Allow Firewall rule for the application and place it at the bottom of the firewall rules below the blue line

Create an Allow Firewall rule for the application and place it at the bottom of the firewall rules above the blue line

Create an Allow All Firewall rule for the fingerprint of the file and place it at the bottom of the firewall rules above the blue line

Create an Allow for the network adapter type used by the application and place it at the top of the firewall rules below the blue line

An administrator needs to increase the access speed for client files that are stored on a file server. Which configuration should the administrator review to address the read speed from the server?

Enable Network Cache in the client's Virus and Spyware Protection policy

Add the applicable server to a trusted host group

Create a Firewall allow rule for the server's IP address.

Enable download randomization in the client group's communication settings

What does a medium-priority incident indicate?

The incident may have an impact on the business

The incident can result in a business outage

The incident does not affect critical business operation

The incident can safely be ignored

Which other items may be deleted when deleting a malicious file from an endpoint?

Registry entries that point to that file

The incident related to the file

SEP Policies related to that file

Files and libraries that point to that file

An administrator needs to identify infected computers that require a restart to finish remediation of a threat. What steps in the SEPM should an administrator perform to identify and restart the systems?

View the Computer Status log to determine if any computers require a restart. Run a command from the Risk log to restart computers.

View the SONAR log to determine if any computers require a restart. Run a command from the Computer Status log to restart computers.

View the Computer Status log to determine if any computers require a restart. Run a command from the SONAR log to restart computers.

View the Computer Status log to determine if any computers require a restart. Run a command from the Attack log to restart computers.

What permissions does the Security Analyst Role have?

Search endpoints, trigger dumps, get & quarantine files

Trigger dumps, get & quarantine files, enroll new sites

Search endpoints, trigger dumps, get & quarantine files

Trigger dumps, get & quarantine files, create device groups

Search endpoints, trigger dumps, create policies

Broadcom 250-580 Practice Test 3 - Free Online Exam Prep & Questions

An organization is considering a single site for their Symantec Endpoint Protection environment. What are two (2) reasons that the organization should consider? (Select two)

Become a Premium Member for full access

Unlock Premium Member

Broadcom 250-580 Practice Test 3

Question

Broadcom 250-580 Practice Tests

Practice Tests