Broadcom 250-580 Exam Dumps (V8.02) – An Effective Strategy to Pass Your Endpoint Security Complete – R2 Technical Specialist Exam

1. What EDR function minimizes the risk of an endpoint infecting other resources in the environment?

2. What priority would an incident that may have an impact on business be considered?

3. Which antimalware intensity level is defined by the following: "Blocks files that are most certainly bad or potentially bad files results in a comparable number of false positives and false negatives."

4. The SES Intrusion Prevention System has blocked an intruder's attempt to establish an IRC connection inside the firewall.

Which Advanced Firewall Protection setting should an administrator enable to prevent the intruder's system from communicating with the network after the IPS detection?

5. After several failed logon attempts, the Symantec Endpoint Protection Manager (SEPM) has locked the default admin account. An administrator needs to make system changes as soon as possible to address an outbreak, but the admin account is the only account.

Which action should the administrator take to correct the problem with minimal impact on the existing environment?

6. Which Incident View widget shows the parent-child relationship of related security events?

7. Which Symantec Endpoint Protection technology blocks a downloaded program from installing browser plugins?

8. Which type of event does operation:1 indicate in a SEDR database search?

9. An Incident Responder has determined that an endpoint is compromised by a malicious threat.

What SEDR feature would be utilized first to contain the threat?

10. If an administrator enables the setting to manage policies from the cloud, what steps must be taken to reverse this process?

11. How would an administrator specify which remote consoles and servers have access to the management server?

12. Which designation should an administrator assign to the computer configured to find unmanaged devices?

13. An administrator notices that some entries list that the Risk was partially removed. The administrator

needs to determine whether additional steps are necessary to remediate the threat.

Where in the Symantec Endpoint Protection Manager console can the administrator find additional information on the risk?

14. Which Endpoint Setting should an administrator utilize to locate unmanaged endpoints on a network subnet?

15. Why is it important for an Incident Responder to copy malicious files to the SEDR file store or create an image of the infected system during the Recovery phase?

16. An administrator changes the Virus and Spyware Protection policy for a specific group that disables Auto-Protect. The administrator assigns the policy and the client systems apply the corresponding policy serial number. Upon visual inspection of a physical client system, the policy serial number is correct. However, Auto-Protect is still enabled on the client system.

Which action should the administrator take to ensure that the desired setting is in place for the client?

17. In the virus and Spyware Protection policy, an administrator sets the First action to Clean risk and sets If first action fails to Delete risk.

Which two (2) factors should the administrator consider? (Select two.)

18. What protection technology should an administrator enable to prevent double executable file names of ransomware variants like Cryptolocker from running?

19. Which Indicator of Compromise might be detected as variations in the behavior of privileged users that indicate that their account is being used by someone else to gain a foothold in an environment?

20. Why is Active Directory a part of nearly every targeted attack?

21. Which technology can prevent an unknown executable from being downloaded through a browser session?

22. What should an administrator know regarding the differences between a Domain and a Tenant in ICDm?

23. Which type of file attribute is valid for creating a block list entry with Symantec Endpoint Detection and Response (SEDR)?

24. Which SES feature helps administrators apply policies based on specific endpoint profiles?

25. What should an administrator utilize to identify devices on a Mac?

26. What is an appropriate use of a file fingerprint list?

27. What is the purpose of a Threat Defense for Active Directory Deceptive Account?

28. When are events generated within SEDR?

29. What tool can administrators use to create custom behavioral isolation policies based on collected application behavior data?

30. A file has been identified as malicious.

Which feature of SEDR allows an administrator to manually block a specific file hash?

31. How does IPS check custom signatures?

32. An Application Control policy includes an Allowed list and a Blocked list. A user wants to use an application that is neither on the Allowed list nor on the Blocked list.

What can the user do to gain access to the application?

33. What does an end-user receive when an administrator utilizes the Invite User feature to distribute the SES client?

34. An organization identifies a threat in its environment and needs to limit the spread of the threat.

How should the SEP Administrator block the threat using Application and Device Control?

35. What EDR feature provides endpoint activity recorder data for a file hash?

36. What Symantec Best Practice is recommended when setting up Active Directory integration with the Symantec Endpoint Protection Manager?

37. Which SES security control protects a user against data leakage if they encounter a man-in-the-middle attack?

38. What happens when an administrator adds a file to the deny list?

39. What is a feature of Cynic?

40. Which IPS signature type is primarily used to identify specific unwanted network traffic?

41. Which SES advanced feature detects malware by consulting a training model composed of known good and known bad files?

42. Files are blocked by hash in the deny list policy.

Which algorithm is supported, in addition to MD5?

43. What is the function of Symantec Insight?

44. What does a ranged query return or exclude?

45. Which type of security threat continues to threaten endpoint security after a system reboot?

46. What information is required to calculate storage requirements?

47. The LiveUpdate Download Schedule is set to the default on the Symantec Endpoint Protection Manager (SEPM).

How many content revisions must the SEPM keep to ensure clients that check in to the SEPM every 10 days receive xdelta content packages instead of full content packages?

48. Which two (2) criteria are used by Symantec Insight to evaluate binary executables? (Select two.)

49. What must be entered before downloading a file from ICDm?

50. Which report template type should an administrator utilize to create a daily summary of network threats detected?