Symantec 250-441 Online Practice Questions and Exam Preparation

Symantec 250-441 Online Questions & Answers

• Question 21:

  Which two widgets can an Incident Responder use to isolate breached endpoints from the Incident details page? (Choose two.)

  A. Affected Endpoints
  B. Dashboard
  C. Incident Graph
  D. Events View
  E. Actions Bar
  C. Incident Graph
  E. Actions Bar

• Question 22:

  What is the earliest stage at which a SQL injection occurs during an Advanced Persistent Threat (APT) attack?

  A. Exfiltration
  B. Incursion
  C. Capture
  D. Discovery
  B. Incursion

• Question 23:

  How can an Incident Responder generate events for a site that was identified as malicious but has NOT triggered any events or incidents in ATP?

  A. Assign a High-Security Antivirus and Antispyware policy in the Symantec Endpoint Protection Manager (SEPM).
  B. Run an indicators of compromise (IOC) search in ATP manager.
  C. Create a firewall rule in the Symantec Endpoint Protection Manager (SEPM) or perimeter firewall that blocks traffic to the domain.
  D. Add the site to a blacklist in ATP manager.
  D. Add the site to a blacklist in ATP manager.

• Question 24:

  Which stage of an Advanced Persistent Threat (APT) attack does social engineering occur?

  A. Capture
  B. Incursion
  C. Discovery
  D. Exfiltration
  B. Incursion

• Question 25:

  Where can an Incident Responder view Cynic results in ATP?

  A. Events
  B. Dashboard
  C. File Details
  D. Incident Details
  D. Incident Details

• Question 26:

  A medium-sized organization with 10,000 users at Site A and 20,000 users at Site B wants to use ATP: Network to scan internet traffic at both sites.

  Which physical appliances should the organization use to act as a network scanner at each site while using the fewest appliances and assuming typical network usage?

  A. Site A 8840 x4 ?Site B 8880 x2
  B. Site A 8880 x2 ?Site B 8840 x1
  C. Site A 8880 x1 ?Site B 8840 x6
  D. Site A 8880 x1 ?Site B 8880 x2
  D. Site A 8880 x1 ?Site B 8880 x2

• Question 27:

  Which threat is an example of an Advanced Persistent Threat (APT)?

  A. Koobface
  B. Brain
  C. Flamer
  D. Creeper
  C. Flamer

• Question 28:

  What is the minimum amount of RAM required for a virtual deployment of the ATP Manager in a production environment?

  A. 48 GB
  B. 64 GB
  C. 16 GB
  D. 32GB
  A. 48 GB

• Question 29:

  Which attribute is required when configuring the Symantec Endpoint Protection Manager (SEPM) Log Collector?

  A. SEPM embedded database name
  B. SEPM embedded database type
  C. SEPM embedded database version
  D. SEPM embedded database password
  D. SEPM embedded database password

• Question 30:

  While filling out the After Actions Report, an Incident Response Team noted that improved log monitoring could help detect future breaches. What are two examples of how an organization can improve log monitoring to help detect future breaches? (Choose two.)

  A. Periodically log into the ATP manager and review only the Dashboard.
  B. Implement IT Analytics to create more flexible reporting.
  C. Dedicate an administrator to monitor new events as they flow into the ATP manager.
  D. Set email notifications in the ATP manager to message the Security team when a new incident is occurring.
  E. Implement Syslog to aggregate information from other systems, including ATP, and review log data in a single console.
  D. Set email notifications in the ATP manager to message the Security team when a new incident is occurring.
  E. Implement Syslog to aggregate information from other systems, including ATP, and review log data in a single console.