Symantec 250-441 Online Practice Questions and Exam Preparation

Symantec 250-441 Online Questions & Answers

• Question 1:

  Which SEP technologies are used by ATP to enforce the blacklisting of files?

  A. Application and Device Control
  B. SONAR and Bloodhound
  C. System Lockdown and Download Insight
  D. Intrusion Prevention and Browser Intrusion Prevention
  C. System Lockdown and Download Insight

• Question 2:

  An Incident Responder discovers an incident where all systems are infected with a file that has the same name and different hash. As a result, the organism view has multiple entries for the malicious file. What is causing this issue?

  A. This is a polymorphic threat
  B. This is a DDoS attack
  C. The file has multiple hashes
  D. The file is trying to phone home
  A. This is a polymorphic threat

• Question 3:

  Which detection method identifies a file as malware after SEP has queried the file's reputation?

  A. Skeptic
  B. Vantage
  C. Insight
  D. Cynic
  C. Insight

• Question 4:

  DRAG DROP

  Which level of privilege corresponds to each ATP account type? Match the correct account type to the corresponding privileges.

  Select and Place:

  

  

• Question 5:

  Which two actions an Incident Responder take when downloading files from the ATP file store? (Choose two.)

  A. Analyze suspicious code with Cynic
  B. Email the files to Symantec Technical Support
  C. Double-click to open the files
  D. Diagnose the files as a threat based on the file names
  E. Submit the files to Security Response
  A. Analyze suspicious code with Cynic
  C. Double-click to open the files

• Question 6:

  Why is it important for an Incident Responder to analyze an incident during the Recovery phase?

  A. To determine the best plan of action for cleaning up the infection
  B. To isolate infected computers on the network and remediate the threat
  C. To gather threat artifacts and review the malicious code in a sandbox environment
  D. To access the current security plan, adjust where needed, and provide reference materials in the event of a similar incident
  D. To access the current security plan, adjust where needed, and provide reference materials in the event of a similar incident

• Question 7:

  Which action should an Incident Responder take to remediate false positives, according to Symantec best practices?

  A. Blacklist
  B. Whitelist
  C. Delete file
  D. Submit file to Cynic
  B. Whitelist

• Question 8:

  What is the second stage of an Advanced Persistent Threat (APT) attack?

  A. Exfiltration
  B. Incursion
  C. Discovery
  D. Capture
  B. Incursion

• Question 9:

  Which default port does ATP use to communicate with the Symantec Endpoint Protection Manager (SEPM) web services?

  A. 8446
  B. 8081
  C. 8014
  D. 1433
  B. 8081

• Question 10:

  Which endpoint detection method allows for information about triggered processes to be displayed in ATP?

  A. SONAR
  B. Insight
  C. System Lockdown
  D. Antivirus
  B. Insight