Symantec SCS 250-315 Questions & Answers

• Question 41:

  An administrator is using the SylinkDrop tool to update a Symantec Endpoint Protection client install on a system. The client fails to migrate to the new Symantec Endpoint Protection Manager (SEPM), which is defined correctly in the Sylink.xml file that was exported from the SEPM. Which settings must be provided with SylinkDrop to ensure the successful migration to a new Symantec Endpoint Protection environment with additional Group Level Security Settings?

  A. -s "silent"

  B. -t "Tamper Protect"

  C. -r "reboot"

  D. -p "password"

  Correct Answer: D

• Question 42:

  Which tool should the administrator run before starting the Symantec Endpoint Protection Manager upgrade as a Symantec Best Practice?

  A. collectLog.cmd

  B. DBValidator.bat

  C. LogExport.cmd

  D. Upgrade.exe

  Correct Answer: B

• Question 43:

  Which Symantec Endpoint Protection defense mechanism provides protection against threats that propagate from system to system through the use of autorun.inf files?

  A. Application and Device Control

  B. SONAR

  C. TruScan

  D. Host Integrity

  Correct Answer: A

• Question 44:

  Which protection technology can detect botnet command and control traffic generated on the Symantec Endpoint Protection client machine?

  A. Insight

  B. SONAR

  C. Risk Tracer

  D. Intrusion Prevention

  Correct Answer: D

• Question 45:

  An administrator uses ClientSideClonePrepTool to clone systems and virtual machine deployment.

  What will the tool do when it is run on each system?

  A. Run Microsoft SysPrep and removes all AntiVirus/AntiSpyware definitions

  B. Disable Tamper Protect and deploys a Sylink.xml

  C. Add a new Extended File Attribute value to all existing files

  D. Remove unique Hardware IDs and GUIDs from the system

  Correct Answer: D

• Question 46:

  After several failed logon attempts, the Symantec Endpoint Protection Manager (SEPM) has locked the default admin account. An administrator needs to make system changes as soon as possible to address an outbreak, but the admin account is the only account. Which action should the administrator take to correct the problem with minimal impact to the existing environment?

  A. wait 15 minutes and attempt to log on again

  B. restore the SEPM from a backup

  C. run the Management Server and Configuration Wizard to reconfigure the server

  D. reinstall the SEPM

  Correct Answer: A

• Question 47:

  Administrators at a company share a single terminal for configuring Symantec Endpoint Protection. The administrators want to ensure that each administrator using the console is forced to authenticate using their individual credentials. They are concerned that administrators may forget to log off the terminal, which would easily allow others to gain access to the Symantec Endpoint Protection Manager (SEPM) console.

  Which setting should the administrator disable to minimize the risk of non-authorized users logging into the SEPM console?

  A. allow users to save credentials when logging on

  B. delete clients that have not connected for specified time

  C. lock account after the specified number of unsuccessful logon attempts

  D. allow administrators to reset the passwords

  Correct Answer: A

• Question 48:

  A large-scale virus attack is occurring and a notification condition is configured to send an email whenever viruses infect five computers on the network. A Symantec Endpoint Protection administrator has set a one hour damper period for that notification condition.

  How many notifications does the administrator receive after 30 computers are infected in two hours?

  A. 1

  B. 2

  C. 6

  D. 15

  Correct Answer: B

• Question 49:

  The Security Status on the console home page is failing to alert a Symantec Endpoint Protection (SEP) administrator when virus definitions are out of date.

  How should the SEP administrator enable the Security Status alert?

  A. lower the Security Status thresholds

  B. raise the Security Status thresholds

  C. change the Notifications setting to "Show all notifications"

  D. change the Action Summary display to "By number of computers"

  Correct Answer: A

• Question 50:

  Which task is unavailable for administrative accounts that authenticate using RSA SecurID Authentication?

  A. reset forgotten passwords

  B. import organizational units (OU) from Active Directory

  C. configure external logging

  D. enable Session Based Authentication with Web Services

  Correct Answer: A