Symantec SCS Certified 250-441 Exam Dumps

1. What is the second stage of an Advanced Persistent Threat (APT) attack?

2. Which SEP technology does an Incident Responder need to enable in order to enforce blacklisting on an endpoint?

3. An Incident Responder wants to create a timeline for a recent incident using Syslog in addition to ATP for the After Actions Report.

What are two reasons the responder should analyze the information using Syslog? (Choose two.)

4. Which SEP technologies are used by ATP to enforce the blacklisting of files?

5. What is the role of Insight within the Advanced Threat Protection (ATP) solution?

6. What are two policy requirements for using the Isolate and Rejoin features in ATP? (Choose two.)

7. Which section of the ATP console should an ATP Administrator use to evaluate prioritized threats within the environment?

8. Which stage of an Advanced Persistent Threat (APT) attack does social engineering occur?

9. Why is it important for an Incident Responder to analyze an incident during the Recovery phase?

10. Which two database attributes are needed to create a Microsoft SQL SEP database connection? (Choose two.)

11. How does an attacker use a zero-day vulnerability during the Incursion phase?

12. Why is it important for an Incident Responder to review Related Incidents and Events when analyzing an incident for an After Actions Report?

13. Which best practice does Symantec recommend with the Endpoint Detection and Response feature?

14. What is the role of Cynic within the Advanced Threat Protection (ATP) solution?

15. Which section of the ATP console should an ATP Administrator use to create blacklists and whitelists?

16. How should an ATP Administrator configure Endpoint Detection and Response according to Symantec best practices for a SEP environment with more than one domain?

17. Which attribute is required when configuring the Symantec Endpoint Protection Manager (SEPM) Log Collector?

18. DRAG DROP

Which level of privilege corresponds to each ATP account type? Match the correct account type to the corresponding privileges.

19. An Incident Responder wants to run a database search that will list all client named starting with SYM.

Which syntax should the responder use?

20. What is the main constraint an ATP Administrator should consider when choosing a network scanner model?

21. Where can an Incident Responder view Cynic results in ATP?

22. An Incident Responder wants to investigate whether msscrt.pdf resides on any systems.

Which search query and type should the responder run?

23. What is the earliest stage at which a SQL injection occurs during an Advanced Persistent Threat (APT) attack?

24. What occurs when an endpoint fails its Host Integrity check and is unable to remediate?

25. Which two tasks should an Incident Responder complete when recovering from an incident? (Choose two.)

26. Which threat is an example of an Advanced Persistent Threat (APT)?

27. An Incident Responder notices traffic going from an endpoint to an IRC channel. The endpoint is listed in an incident. ATP is configured in TAP mode.

What should the Incident Responder do to stop the traffic to the IRC channel?

28. Which prerequisite is necessary to extend the ATP: Network solution service in order to correlate email detections?