Symantec 250-441 Online Practice Questions and Exam Preparation

Symantec 250-441 Online Questions & Answers

• Question 31:

  What is the role of Synapse within the Advanced Threat Protection (ATP) solution?

  A. Reputation-based security
  B. Event correlation
  C. Network detection component
  D. Detonation/sandbox
  B. Event correlation

• Question 32:

  An Incident Responder wants to create a timeline for a recent incident using Syslog in addition to ATP for the After Actions Report.

  What are two reasons the responder should analyze the information using Syslog? (Choose two.)

  A. To have less raw data to analyze
  B. To evaluate the data, including information from other systems
  C. To access expanded historical data
  D. To determine what policy settings to modify in the Symantec Endpoint Protection Manager (SEPM)
  E. To determine the best cleanup method
  B. To evaluate the data, including information from other systems
  E. To determine the best cleanup method

• Question 33:

  Which section of the ATP console should an ATP Administrator use to evaluate prioritized threats within the environment?

  A. Search
  B. Action Manager
  C. Incident Manager
  D. Events
  B. Action Manager

• Question 34:

  A large company has 150,000 endpoints with 12 SEP sites across the globe. The company now wants to implement ATP: Endpoint to improve their security. However, a consultant recently explained that the company needs to implement more than one ATP manager.

  Why does the company need more than one ATP manager?

  A. An ATP manager can only connect to a SQL backend
  B. An ATP manager can only support 30,000 SEP clients
  C. An ATP manager can only support 10 SEP site connections.
  D. An ATP manager needs to be installed at each location where a Symantec Endpoint Protection Manager (SEPM) is located.
  D. An ATP manager needs to be installed at each location where a Symantec Endpoint Protection Manager (SEPM) is located.

• Question 35:

  An ATP Administrator has deployed ATP: Network, Endpoint, and Email and now wants to ensure that all connections are properly secured. Which connections should the administrator secure with signed SSL certificates?

  A. ATP and the Symantec Endpoint Protection Manager (SEPM) ATP and SEP clients Web access to the GUI
  B. ATP and the Symantec Endpoint Protection Manager (SEPM) ATP and SEP clients ATP and Email Security.cloud Web access to the GUI
  C. ATP and the Symantec Endpoint Protection Manager (SEPM)
  D. ATP and the Symantec Endpoint Protection Manager (SEPM) Web access to the GUI
  C. ATP and the Symantec Endpoint Protection Manager (SEPM)

• Question 36:

  Which policies are required for the quarantine feature of ATP to work?

  A. Firewall Policy and Host Integrity Policy
  B. Quarantine Policy and Firewall Policy
  C. Host Integrity Policy and Quarantine Policy
  D. Quarantine and Intrusion Prevention Policy
  C. Host Integrity Policy and Quarantine Policy

• Question 37:

  What is the role of Vantage within the Advanced Threat Protection (ATP) solution?

  A. Network detection component
  B. Event correlation
  C. Reputation-based security
  D. Detonation/sandbox
  A. Network detection component

• Question 38:

  Refer to the exhibit. An Incident Responder wants to see what was detected on a specific day by the IPS engine.

  Which item must the responder choose from the drop-down menu?

  

  A. Insight
  B. Cynic
  C. Vantage
  D. Blacklist
  A. Insight

• Question 39:

  An Incident Responder added a file's MD5 hash to the blacklist. Which component of SEP enforces the blacklist?

  A. Bloodhound
  B. System Lockdown
  C. Intrusion Prevention
  D. SONAR
  B. System Lockdown

• Question 40:

  An Incident Responder is going to run an indicators of compromise (IOC) search on the endpoints and wants to use operators in the expression. Which tokens accept one or more of the available operators when building an expression?

  A. All tokens
  B. Domainname, Filename, and Filehash
  C. Filename, Filehash, and Registry
  D. Domainname and Filename only
  C. Filename, Filehash, and Registry