Symantec Symantec Certified Specialist 250-441 Questions & Answers

• Question 1:

  Which level of privilege corresponds to each ATP account type? Match the correct account type to the corresponding privileges.

  Select and Place:

  

  Correct Answer:

  

• Question 2:

  Which level of privilege corresponds to each ATP account type? Match the correct account type to the corresponding privileges.

  Select and Place:

  Correct Answer:

  

  

  Reference: https://support.symantec.com/us/en/article.HOWTO125620.html

• Question 3:

  Which level of privilege corresponds to each ATP account type? Match the correct account type to the corresponding privileges.

  Select and Place:

  

  Correct Answer:

  

• Question 4:

  A network control point discovered a botnet phone-home attempt in the network stream.

  Which detection method identified the event?

  A. Vantage

  B. Insight

  C. Antivirus

  D. Cynic

  Correct Answer: C

• Question 5:

  An organization recently deployed ATP and integrated it with the existing SEP environment. During an

  outbreak, the Incident Response team used ATP to isolate several infected endpoints. However, one of the

  endpoints could NOT be isolated.

  Which SEP protection technology is required in order to use the Isolate and Rejoin features in ATP?

  A. Intrusion Prevention

  B. Firewall

  C. SONAR

  D. Application and Device Control

  Correct Answer: B

  Reference: https://support.symantec.com/us/en/article.HOWTO125535.html

• Question 6:

  A customer has information about a malicious file that has NOT entered the network. The customer wants to know whether ATP is already aware of this threat without having to introduce a copy of the file to the infrastructure.

  Which approach allows the customer to meet this need?

  A. Use the Cynic portal to check whether the MD5 hash triggers a detection from Cynic

  B. Use the ATP console to check whether the SHA-256 hash triggers a detection from Cynic

  C. Use the ATP console to check whether the MD5 hash triggers a detection from Cynic

  D. Use the Cynic portal to check whether the SHA-256 hash triggers a detection from Cynic

  Correct Answer: C

• Question 7:

  An organization has five (5) shops with a few endpoints and a large warehouse where 98% of all computers are located. The shops are connected to the warehouse using leased lines and access internet through the warehouse network.

  How should the organization deploy the network scanners to observe all inbound and outbound traffic based on Symantec best practices for Inline mode?

  A. Deploy a virtual network scanner at each shop

  B. Deploy a virtual network scanner at the warehouse and a virtual network scanner at each shop

  C. Deploy a physical network scanner at each shop

  D. Deploy a physical network scanner at the warehouse gateway

  Correct Answer: D

• Question 8:

  Which policies are required for the quarantine feature of ATP to work?

  A. Firewall Policy and Host Integrity Policy

  B. Quarantine Policy and Firewall Policy

  C. Host Integrity Policy and Quarantine Policy

  D. Quarantine and Intrusion Prevention Policy

  Correct Answer: C

  Reference: https://support.symantec.com/us/en/article.tech248959.html

• Question 9:

  Which access credentials does an ATP Administrator need to set up a deployment of ATP: Endpoint, Network, and Email?

  A. Email Security.cloud credentials for email correlation, credentials for the Symantec Endpoint Protection Manager (SEPM) database, and a System Administrator login for the SEPM

  B. Active Directory login to the Symantec Endpoint Protection Manager (SEPM) database, and an Email Security.cloud login with full access

  C. Symantec Endpoint Protection Manager (SEPM) login and ATP: Email login with service permissions

  D. Credentials for the Symantec Endpoint Protection Manager (SEPM) database, and an administrator login for Symantec Messaging Gateway

  Correct Answer: C

  Reference: https://support.symantec.com/us/en/article.howto124667.html

• Question 10:

  Which two actions an Incident Responder take when downloading files from the ATP file store? (Choose two.)

  A. Analyze suspicious code with Cynic

  B. Email the files to Symantec Technical Support

  C. Double-click to open the files

  D. Diagnose the files as a threat based on the file names

  E. Submit the files to Security Response

  Correct Answer: AC