250-441 Exam Training Practice Tests (Symantec Administration of Symantec Advanced Threat Protection 3.0)]

Question 1

Which detection method identifies a file as malware after SEP has queried the file's reputation?

A. Vantage B. Cynic C. Skeptic D. insight

Correct Answer: D

Question 2

An Incident Responder needs to remediate a group of endpoints but also wants to copy a potentially suspicious file to the ATP file store.
In which scenario should the Incident Responder copy a suspicious file to the ATP file store?

A. The responder needs to add the file to a whitelist B. The responder needs to write firewall rules C. The responder needs to isolate it from the network D. The responder needs to analyze with Cynic

Correct Answer: D

Question 3

Which threat is an example of an Advanced Persistent Threat (APT)?

A. Zeus B. Code Red C. Duqu D. Melissa

Correct Answer: C

Question 4

Which level of privilege corresponds to each ATP account type?
Match the correct account type to the corresponding privileges.

Correct Answer:

Question 5

Refer to the exhibit. An Incident Responder wants to see what was detected on a specific day by the IPS engine.
Which item must the responder choose from the drop-down menu?

A. Vantage B. Cynic C. Insight D. Blacklist

Correct Answer: C

Question 6

An ATP administrator is setting up correlation with Email Security cloud.
What is the minimum Email Security cloud account privilege required?

A. Standard User Role -Port B. Standard User Role - Service C. Standard User Role - Support D. Standard User Role - Full Access

Correct Answer: B

Question 7

What occurs when an endpoint fails its Host Integrity check and is unable to remediate?

A. The endpoint automatically switches to using a Host Integrity location, where a Host Integrity policy is applied to the computer. B. The endpoint automatically switches to using a Quarantine location, where a Quarantine policy is applied to the computer. C. The endpoint automatically switches to using a System Lockdown location, where a System Lockdown policy is applied to the computer. D. The endpoint automatically switches to using a Compliance location, where a Compliance policy is applied to the computer.

Correct Answer: B

Question 8

During a recent virus outlook, an Incident found that the incident Response team was successful in identifying malicious that were communicating with the infected endpoint.
Which two (2) options should be incident Responder select to prevent endpoints from communicating with malicious domains?

A. Use the isolation command in ATP to move endpoint to quarantine network. B. Deploy a high-Security antivirus and Antispyware policy in the Symantec Endpoint protection Manager (SEPM.) C. Run a full system scan on all endpoints D. Blacklist suspicious domain in the ATP manager. E. Create a firewall rule in the Symantec Endpoints Protection Manager (SEPM) or perimeter firewall that blocks F. traffic to the domain.

Correct Answer: A,D

Question 9

An Incident Responder discovers an incident where all systems are infected with a file that has the same name and different hash. As a result, the organism view has multiple entries for the malicious file.
What is causing this issue?

A. This is a polymorphic threat B. The file has multiple hashes C. This is a DDoS attack D. The file is trying to phone home

Correct Answer: A

Question 10

An ATP Administrator set up ATP: Network in TAP mode and has placed URLs on the blacklist.
What will happen when a user attempts to access one of the blacklisted URLs?

A. Access to the website is allowed by the network scanner but blocked by ATP: Endpoint and an endpoint event is generated B. Access to the website is blocked by the network scanner but an event is NOT generated C. Access to the website is allowed by the network scanner but a network event is generated D. Access to the website is blocked by the network scanner and a network event is generated

Correct Answer: C

Symantec Administration of Symantec Advanced Threat Protection 3.0 - 250-441 Exam Practice Test