Symantec Symantec Certified Specialist 250-441 Questions & Answers

• Question 81:

  What is the role of Cynic within the Advanced Threat Protection (ATP) solution?

  A. Reputation-based security

  B. Event correlation

  C. Network detection component

  D. Detonation/sandbox

  Correct Answer: D

  Reference: https://www.symantec.com/content/en/us/enterprise/fact_sheets/b-advanced-threat-protectionemail-DS-21349610.pdf

• Question 82:

  Which section of the ATP console should an ATP Administrator use to create blacklists and whitelists?

  A. Reports

  B. Settings

  C. Action Manager

  D. Policies

  Correct Answer: D

  Reference: https://symwisedownload.symantec.com//resources/sites/SYMWISE/content/live/ DOCUMENTATION/10000/DOC10986/en_US/satp_administration_guide_3.1.pdf? __gda__=1541979133_5668f0b4c03c16ac1a30d54989313e76 (132)

• Question 83:

  Which best practice does Symantec recommend with the Endpoint Detection and Response feature?

  A. Create a unique Cynic account to provide to ATP

  B. Create a unique Symantec Messaging Gateway account to provide to ATP

  C. Create a unique Symantec Endpoint Protection Manager (SEPM) administrator account to provide to ATP

  D. Create a unique Email Security.cloud portal account to provide to ATP

  Correct Answer: C

• Question 84:

  Why is it important for an Incident Responder to review Related Incidents and Events when analyzing an incident for an After Actions Report?

  A. It ensures that the Incident is resolved, and the responder can clean up the infection.

  B. It ensures that the Incident is resolved, and the responder can determine the best remediation method.

  C. It ensures that the Incident is resolved, and the threat is NOT continuing to spread to other parts of the environment.

  D. It ensures that the Incident is resolved, and the responder can close out the incident in the ATP manager.

  Correct Answer: C

• Question 85:

  Which two database attributes are needed to create a Microsoft SQL SEP database connection? (Choose two.)

  A. Database version

  B. Database IP address

  C. Database domain name

  D. Database hostname

  E. Database name

  Correct Answer: BD

• Question 86:

  How does an attacker use a zero-day vulnerability during the Incursion phase?

  A. To perform a SQL injection on an internal server

  B. To extract sensitive information from the target

  C. To perform network discovery on the target

  D. To deliver malicious code that breaches the target

  Correct Answer: D

  Reference: https://www.symantec.com/connect/blogs/guide-zero-day-exploits

• Question 87:

  Which stage of an Advanced Persistent Threat (APT) attack does social engineering occur?

  A. Capture

  B. Incursion

  C. Discovery

  D. Exfiltration

  Correct Answer: B

• Question 88:

  Why is it important for an Incident Responder to analyze an incident during the Recovery phase?

  A. To determine the best plan of action for cleaning up the infection

  B. To isolate infected computers on the network and remediate the threat C. To gather threat artifacts and review the malicious code in a sandbox environment

  D. To access the current security plan, adjust where needed, and provide reference materials in the event of a similar incident

  Correct Answer: D

• Question 89:

  Which section of the ATP console should an ATP Administrator use to evaluate prioritized threats within the environment?

  A. Search

  B. Action Manager

  C. Incident Manager

  D. Events

  Correct Answer: B

• Question 90:

  What are two policy requirements for using the Isolate and Rejoin features in ATP? (Choose two.)

  A. Add a Quarantine firewall policy for non-compliant and non-remediated computers.

  B. Add a Quarantine LiveUpdate policy for non-compliant and non-remediated computers.

  C. Add and assign an Application and Device Control policy in the Symantec Endpoint Protection Manager (SEPM).

  D. Add and assign a Host Integrity policy in the Symantec Endpoint Protection Manager (SEPM).

  E. Add a Quarantine Antivirus and Antispyware policy for non-compliant and non-remediated computers.

  Correct Answer: AD

  Reference: https://support.symantec.com/en_US/article.HOWTO128427.html