250-580 Exam Training Practice Tests (Symantec Endpoint Security Complete

Question 1

Which SEP feature is required for using the SEDR Isolate function?

A. Application Detection B. Host Isolation Policy C. Host Integrity Policy D. Application Control

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

Which SES feature helps to ensure that devices are compliant with a company's security standards?

A. Intensive Protection B. Adaptive Protection C. Trusted Updater D. Host Integrity

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

SES includes an advanced policy versioning system. When an administrator edits and saves the properties of an existing policy, a new version of the policy is created. What is the status of all previous versions of the policy?

A. They are deleted after 30 days B. They are added to the policy archive list C. They are marked dormant until reactivated D. They are active and can be assigned

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

What must be entered before downloading a file from ICDm?

A. Password B. Hash C. Name D. Date

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

What version number is assigned to a duplicated policy?

A. Zero B. The original policy's version number C. The original policy's number plus one D. One

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

How does IPS check custom signatures?

A. IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine continues checking for other signatures. B. IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine logs the other signatures. C. IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine restarts checking for signatures. D. IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine stops checking other signatures.

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

Which of the following are considered entities in SES Complete?

A. Domain, Endpoint, File B. Domain, Endpoint, Process C. Domain, File, Process D. Endpoint, File, Process

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 8

An administrator is investigating a possible threat that occurs during the Windows startup. A file is observed that is NOT digitally signed by Microsoft. Which Anti-malware feature should the administrator enable to scan this file for threats?

A. Enable Behavioral Analysis B. Enable Auto-Protect C. Enable Microsoft ELAM D. Enable Early Launch Antimalware

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

Which action does SONAR take before convicting a process?

A. Checks the reputation of the process B. Blocks suspicious behavior C. Quarantines the process D. Restarts the system

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 10

Which type of security threat continues to threaten endpoint security after a system reboot?

A. script B. memory attack C. Rootkit D. file-less

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 11

What priority would an incident that may have an impact on business be considered?

A. Medium B. High C. Low D. Critical

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 12

An administrator notices that some entries list that the Risk was partially removed. The administrator needs to determine whether additional steps are necessary to remediate the threat.
Where in the Symantec Endpoint Protection Manager console can the administrator find additional information on the risk?

A. Notifications B. Infected and At-Risk Computers report C. Computer Status report D. Risk log

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 13

What protection technology should an administrator enable to prevent double executable file names of ransomware variants like Cryptolocker from running?

A. Download Insight B. Memory Exploit Mitigation C. SONAR D. Intrusion Prevention System

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 14

What Symantec Best Practice is recommended when setting up Active Directory integration with the Symantec Endpoint Protection Manager?

A. Link the built-in Admin account to an Active Directory account. B. Import the existing AD structure to organize clients in user mode. C. Ensure there is more than one Active Directory Server listed in the Server Properties. D. Secure the management console by denying access to certain computers.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 15

Which report template type should an administrator utilize to create a daily summary of network threats detected?

A. Access Violation Report B. Intrusion Prevention Report C. Blocked Threats Report D. Network Risk Report

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Symantec Endpoint Security Complete - Administration R2 - 250-580 Exam Practice Test