Symantec Symantec Certified Security program ST0-134 Questions & Answers

• Question 1:

  Which statement is true about the Database Backup and Restore utility?

  A. It backs up and restores only an embedded database.

  B. It allows an administrator to pause and resume backups.

  C. It saves database backups to the local computer.

  D. It backs up and restores the certificate keystore.

  Correct Answer: B

• Question 2:

  In addition to adding exceptions directly into an Exceptions policy, what is another method of adding exceptions?

  A. adding the exception to a policy from the Application Control log

  B. importing the exception into a policy from the Notifications window

  C. adding the application exception to a File Fingerprint list

  D. adding the exception from the Threat report

  Correct Answer: A

• Question 3:

  A managed Symantec Endpoint Protection 12.1 (SEP) client is in a group that has a Virus and Spyware Protection policy specifying that all files must be scanned. An Exceptions policy has been applied to the group by the SEP administrator. The Exceptions policy has an empty exclusions list. A local user of the client has added an Exception to exclude C\temp. What will happen if a user attempts to download a file to the C\temp folder?

  A. The local exclusion will be ignored.

  B. The user will be prompted to override the group's policy.

  C. The local exclusion will allow malware.

  D. The group's policy will negate the local exception.

  Correct Answer: C

• Question 4:

  In addition to preventing Symantec Endpoint Protection 12.1 (SEP) from being stopped maliciously, which other two functions does Tamper Protection perform? (Select two.)

  A. It prevents a user from stopping the SEP services.

  B. It prevents the SEP Registry keys from being deleted.

  C. It prevents SEP from stopping third party applications.

  D. It prevents the SEP files and folders from being changed.

  E. It prevents the user from opening the SEP client interface.

  Correct Answer: BD

• Question 5:

  An administrator enabled virtual image exceptions for Auto-Protect and Administrator-Defined scans on virtual machines. In order to protect against previously undetected threats, the administrator must regularly scan the static instance of the virtual machine image set which includes the files that have been whitelisted. In addition to cleaning the static image set, which additional step must the administrator complete if threats are discovered?

  A. Select the threat in the log and add it as an exception.

  B. Use the Symantec Offline Image Scanner (SOIS) on the static image.

  C. Ensure that virtual client tagging is enabled.

  D. Use the vietool to update the whitelist.

  Correct Answer: D

• Question 6:

  A user is downloading a file from https//www.example.com to the local system. The user is able to download and save that file even though it is a known malicious application. Why is the user able to download the application?

  A. A SONAR exception is in place.

  B. An Application Control exception for the file is in place.

  C. A Trusted Web Domain exception is in place.

  D. Download Insight exceptions are disabled.

  Correct Answer: C

• Question 7:

  Which statement describes a difference between Virtual Image Exceptions (VIE) and Shared Insight Cache (SIC)?

  A. VIE tracks executable files, whereas SIC tracks all file types.

  B. VIE data is stored on the local system, whereas SIC data is placed in a shared location.

  C. SIC tracks whitelisted and malicious files, whereas VIE tracks only whitelisted files.

  D. SIC can query Symantec Insight, whereas VIE is unable to make Symantec Insight queries.

  Correct Answer: B

• Question 8:

  Refer to the exhibit. A customer configures location awareness as displayed in the exhibit, but the client fails to change from the Out of Office location to the Office location, even though it is connected to the Symantec Endpoint Protection Manager. What is wrong?

  A. The client connection specific DNS suffix needs to be example.com.

  B. The Remember Last Location setting is enabled.

  C. The Enable Location Awareness setting is disabled.

  D. The Out of Office location is the default location.

  Correct Answer: C

• Question 9:

  A large enterprise plans to deploy Symantec Endpoint Protection 12.1 (SEP) on 36,000 virtual endpoints distributed across 1,800 VMware ESX servers in a single datacenter. A system administrator needs to optimize endpoint scanning performance by enabling Shared Insight Cache (SIC) server functionality. Which two configuration changes should the administrator make to minimize the number of SIC servers that need to be deployed? (Select two.)

  A. Perform regular scans of all virtual systems with the offline image scanner.

  B. Enable scanning randomization across all SEP endpoints.

  C. Enable virtual image exceptions across all SEP endpoints.

  D. Disable Insight lookups for threat detection on each virtual SEP endpoint.

  E. Enable download randomization across all SEP endpoints.

  Correct Answer: BC

• Question 10:

  Which technology does the Symantec Endpoint Protection Firewall use?

  A. proxy inspection

  B. packet filtering

  C. stateful packet inspection

  D. application gateway proxy

  Correct Answer: D