Symantec 250-441 Online Practice Questions and Exam Preparation

Symantec 250-441 Online Questions & Answers

• Question 11:

  Which access credentials does an ATP Administrator need to set up a deployment of ATP: Endpoint, Network, and Email?

  A. Email Security.cloud credentials for email correlation, credentials for the Symantec Endpoint Protection Manager (SEPM) database, and a System Administrator login for the SEPM
  B. Active Directory login to the Symantec Endpoint Protection Manager (SEPM) database, and an Email Security.cloud login with full access
  C. Symantec Endpoint Protection Manager (SEPM) login and ATP: Email login with service permissions
  D. Credentials for the Symantec Endpoint Protection Manager (SEPM) database, and an administrator login for Symantec Messaging Gateway
  C. Symantec Endpoint Protection Manager (SEPM) login and ATP: Email login with service permissions

• Question 12:

  What occurs when an endpoint fails its Host Integrity check and is unable to remediate?

  A. The endpoint automatically switches to using a Compliance location, where a Compliance policy is applied to the computer.
  B. The endpoint automatically switches to using a System Lockdown location, where a System Lockdown policy is applied to the computer.
  C. The endpoint automatically switches to using a Host Integrity location, where a Host Integrity policy is applied to the computer.
  D. The endpoint automatically switches to using a Quarantine location, where a Quarantine policy is applied to the computer.
  D. The endpoint automatically switches to using a Quarantine location, where a Quarantine policy is applied to the computer.

• Question 13:

  DRAG DROP

  Which level of privilege corresponds to each ATP account type? Match the correct account type to the corresponding privileges.

  Select and Place:

  

  

• Question 14:

  An Incident Responder wants to run a database search that will list all client named starting with SYM.

  Which syntax should the responder use?

  A. hostname like "SYM"
  B. hostname "SYM"
  C. hostname "SYM*"
  D. hostname like "SYM*"
  A. hostname like "SYM"

• Question 15:

  What does a Quarantine Firewall policy enable an ATP Administrator to do?

  A. Isolate a computer while it is manually being remediated
  B. Submit files to a Central Quarantine server
  C. Filter all traffic leaving the network
  D. Intercept all traffic entering the network
  A. Isolate a computer while it is manually being remediated

• Question 16:

  An Incident Responder wants to use a STIX file to run an indicators of compromise (IOC) search. Which format must the administrator use for the file?

  A. .csv
  B. .xml
  C. .mht
  D. .html
  B. .xml

• Question 17:

  What impact does changing from Inline Block to SPAN/TAP mode have on blacklisting in ATP?

  A. ATP will continue to block previously blacklisted addresses but NOT new ones.
  B. ATP does NOT block access to blacklisted addresses unless block mode is enabled.
  C. ATP will clear the existing blacklists.
  D. ATP does NOT block access to blacklisted addresses unless TAP mode is enabled.
  B. ATP does NOT block access to blacklisted addresses unless block mode is enabled.

• Question 18:

  Which two questions can an Incident Responder answer when analyzing an incident in ATP? (Choose two.)

  A. Does the organization need to do a healthcheck in the environment?
  B. Are certain endpoints being repeatedly attacked?
  C. Is the organization being attacked by this external entity repeatedly?
  D. Do ports need to be blocked or opened on the firewall?
  E. Does a risk assessment need to happen in the environment?
  B. Are certain endpoints being repeatedly attacked?
  E. Does a risk assessment need to happen in the environment?

• Question 19:

  An ATP administrator is setting up correlation with Email Security.cloud. What is the minimum Email Security.cloud account privilege required?

  A. Standard User Role - Report
  B. Standard User Role - Service
  C. Standard User Role - Support
  D. Standard User Role - Full Access
  B. Standard User Role - Service

• Question 20:

  Which stage of an Advanced Persistent Threat (APT) attack do attackers map an organization's defenses from the inside?

  A. Discovery
  B. Capture
  C. Exfiltration
  D. Incursion
  A. Discovery