Symantec Symantec Certified Security program ST0-134 Questions & Answers

• Question 91:

  Acrobat Reader is being targeted by a threat using process injection. Which feature of SONAR is sandboxing Acroread32.exe so that the threat is prevented from dropping its payload?

  A. Commercial Application Detection

  B. Suspicious Behavior Detection

  C. System Change Events

  D. Signature Based Detection

  Correct Answer: B

• Question 92:

  What could be an adverse effect of activating aggressive mode on the SONAR policy?

  A. false negatives

  B. false positives

  C. performance issues

  D. higher rejection rate

  Correct Answer: B

• Question 93:

  Which two options are available when configuring high risk detection in SONAR? (Select two.)

  A. Block

  B. Skip

  C. Quarantine

  D. Log E. Delete

  Correct Answer: CD

• Question 94:

  Refer to the exhibit.

  

  In the use case displayed in the exhibit, why is the administrator unable to save the changes to this file?

  A. Application Control is preventing Notepad from accessing the host file.

  B. SONAR is set to block host file modifications.

  C. Tamper Protection is enabled.

  D. The Auto-Protect feature detected a malicious activity.

  Correct Answer: B

• Question 95:

  Which technology uses heuristics to scan outbound email?

  A. Internet Email Auto-Protect

  B. Microsoft Outlook Auto-Protect

  C. Lotus Notes Auto-Protect

  D. SONAR

  Correct Answer: A

• Question 96:

  Which type of email does Internet Email Auto-Protect support?

  A. IMAP based email

  B. HTTP/s based email

  C. SMTP based email

  D. Outlook Web Access (OWA)

  Correct Answer: C

• Question 97:

  An administrator is modifying a Virus and Spyware Protection policy for a Symantec Endpoint Protection

  12.1 (SEP) client because it is demonstrating poor boot performance. Which option should the administrator consider to alleviate this problem?

  A. Ensure that Risk Tracer is disabled.

  B. Load Auto-Protect during the startup of SEP.

  C. Enable File Cache across reboots.

  D. Modify the policy to use Insight Cache.

  Correct Answer: B

• Question 98:

  A Symantec Endpoint Protection 12.1 administrator has the Virus and Spyware Protection policy configured with Auto-Protect enabled. The administrator is confronted with computer performance issues. Which two options can the administrator use to improve performance? (Select two.)

  A. Enable the option to Trust Files on Remote Computers Running Auto-Protect.

  B. Enable the Risk Tracer option.

  C. Edit the autoprotect.xml and increase the cache value.

  D. Enable the option of Network Cache.

  E. Enable the Preserve File Times option.

  Correct Answer: AD

• Question 99:

  A Symantec Endpoint Protection 12.1 client is running a user-defined scan when a scheduled, administrator-defined scan is scheduled to launch. What is the effect on the client?

  A. The user-defined scan will be paused in order to launch the administrator-defined scan.

  B. The administrator-defined scan will launch after the user-defined scan completes.

  C. The user-defined scan will be canceled in order to launch the administrator-defined scan.

  D. The administrator-defined scan will be skipped and the user-defined scan will continue.

  Correct Answer: B

• Question 100:

  Which protection technology assists in protecting documents in real-time when accessed or modified?

  A. SONAR

  B. Reputation Scans

  C. Auto-Protect

  D. Scheduled Scans

  Correct Answer: C