Symantec Symantec Certified Security program ST0-134 Questions & Answers

• Question 151:

  How many Symantec Endpoint Protection Managers can be connected to an embedded database?

  A. 1

  B. 2

  C. 5

  D. 10

  Correct Answer: A

• Question 152:

  A company is experiencing a malware outbreak. The company deploys Symantec Endpoint Protection 12.1, with only Virus and Spyware Protection, Application and Device Control, and Intrusion Prevention technologies. Why would Intrusion Prevention be unable to block all communications from an attacking host?

  A. Intrusion Prevention needs the firewall component to block all traffic from the attacking host.

  B. Intrusion Prevention blocks the attack only if the administrator wrote a signature for it.

  C. Intrusion Prevention definitions are out-of-date.

  D. Intrusion Prevention is set to log only.

  Correct Answer: A

• Question 153:

  Which Symantec Endpoint Protection 12.1 component uses reputation to evaluate a file?

  A. Shared Insight Cache server

  B. Symantec Endpoint Protection client

  C. Symantec Endpoint Protection Manager

  D. LiveUpdate Administrator server

  Correct Answer: B

• Question 154:

  Drive-by downloads are a common vector of infections. Some of these attacks use encryption to bypass traditional defense mechanisms. Which Symantec Endpoint Protection 12.1 protection technology blocks such obfuscated attacks?

  A. SONAR

  B. Bloodhound heuristic virus detection

  C. Client Firewall

  D. Browser Intrusion Prevention

  Correct Answer: D

• Question 155:

  Which Symantec Endpoint Protection 12.1 defense mechanism provides protection against worms like W32.Silly.FDC, which propagate from system to system through the use of autorun.inf files?

  A. Application Control

  B. SONAR

  C. Client Firewall

  D. Exceptions

  Correct Answer: A

• Question 156:

  The fake antivirus family "PC scout" infects systems with a similar method regardless of its variant. Which SONAR sub-feature can block new variants of the same family, based on sequence of events?

  A. artificial intelligence

  B. behavioral heuristic

  C. human authored signatures

  D. behavioral policy lockdown

  Correct Answer: C

• Question 157:

  How does the Intrusion Prevention System add an additional layer of protection to Network Threat Protection?

  A. It inspects the TCP packet headers and tracks the sequence number.

  B. It performs deep packet inspection, reading the packet headers, and data portion.

  C. It examines TCP/IP traffic from the application and traces the source of the traffic.

  D. It monitors IP datagrams for abnormalities.

  Correct Answer: B

• Question 158:

  Which feature can be configured to increase or decrease performance of scheduled scans?

  A. scan frequency

  B. CPU throttling

  C. heartbeat interval

  D. tuning options

  Correct Answer: A

• Question 159:

  A financial company has a security policy that prevents banking system workstations from connecting to the internet. Which Symantec Endpoint Protection 12.1 protection technology will be prevented from working on the company's workstations?

  A. Insight

  B. Application and Device Control

  C. Network Threat Protection

  D. LiveUpdate

  Correct Answer: A

• Question 160:

  A threat was detected by Auto-Protect on a client system. Which command can an administrator run to determine whether additional threats exist?

  A. Restart Client Computer

  B. Update Content and Scan

  C. Enable Network Threat Protection

  D. Enable Download Insight

  Correct Answer: A