250-441 Free Questions – Administration of Symantec Advanced Threat Protection 3.0 – PassQuestion Free Questions To Test Online

1. What is the second stage of an Advanced Persistent Threat (APT) attack?

Exfiltration

Incursion

Discovery

Capture

2. Which SEP technology does an Incident Responder need to enable in order to enforce blacklisting on an endpoint?

System Lockdown

Intrusion Prevention System

Firewall

SONAR

3. An Incident Responder wants to create a timeline for a recent incident using Syslog in addition to ATP for the After Actions Report.

What are two reasons the responder should analyze the information using Syslog? (Choose two.)

To have less raw data to analyze

To evaluate the data, including information from other systems

To access expanded historical data

To determine what policy settings to modify in the Symantec Endpoint Protection Manager (SEPM)

To determine the best cleanup method

4. Which SEP technologies are used by ATP to enforce the blacklisting of files?

Application and Device Control

SONAR and Bloodhound

System Lockdown and Download Insight

Intrusion Prevention and Browser Intrusion Prevention

5. What is the role of Insight within the Advanced Threat Protection (ATP) solution?

Reputation-based security

Detonation/sandbox

Network detection component

Event correlation

6. What are two policy requirements for using the Isolate and Rejoin features in ATP? (Choose two.)

Add a Quarantine firewall policy for non-compliant and non-remediated computers.

Add a Quarantine LiveUpdate policy for non-compliant and non-remediated computers.

Add and assign an Application and Device Control policy in the Symantec Endpoint Protection Manager (SEPM).

Add and assign a Host Integrity policy in the Symantec Endpoint Protection Manager (SEPM).

Add a Quarantine Antivirus and Antispyware policy for non-compliant and non-remediated computers.

7. Which section of the ATP console should an ATP Administrator use to evaluate prioritized threats within the environment?

Action Manager

Incident Manager

Events

8. Which stage of an Advanced Persistent Threat (APT) attack does social engineering occur?

Capture

Incursion

Discovery

Exfiltration

9. Why is it important for an Incident Responder to analyze an incident during the Recovery phase?

To determine the best plan of action for cleaning up the infection

To isolate infected computers on the network and remediate the threat

To gather threat artifacts and review the malicious code in a sandbox environment

To access the current security plan, adjust where needed, and provide reference materials in the event of a similar incident

10. Which two database attributes are needed to create a Microsoft SQL SEP database connection? (Choose two.)

Database version

Database IP address

Database domain name

Database hostname

Database name

250-441 Free Questions – Administration of Symantec Advanced Threat Protection 3.0

250-441 Free Questions – Administration of Symantec Advanced Threat Protection 3.0

Leave a Reply Cancel reply