250-605 Exam Training Practice Tests (Symantec Endpoint Protection 14.x Admin R2 Technical Specialist)]

Question 1

Which two types of events can be monitored in SEPM to verify that Intrusion Prevention is functioning correctly?
(Choose two)

A. Dropped or blocked packets by the firewall B. DNS blacklist lookups C. Custom signature trigger alerts D. IPS signature matches on client machines

Correct Answer: C,D

Question 2

What is the primary role of Symantec's Insight Lookup feature in SEP?

A. To validate file reputations using global telemetry B. To manage firewall rules for remote devices C. To create device control policies for mobile users D. To distribute definition updates

Correct Answer: A

Question 3

What feature allows SEP administrators to create organization-specific Intrusion Prevention rules?

A. Symantec Insight B. Host Lookup Override C. Log Correlation Engine D. Custom Signature Configuration

Correct Answer: D

Question 4

When configuring a scheduled report in SEPM, which two parameters must be defined?
(Choose two)

A. Time zone of the SEPM server B. Report type or category (e.g., Risk, Health, Compliance) C. Export destination path on the client D. Recurrence schedule (e.g., Daily, Weekly)

Correct Answer: B,D

Question 5

How does SEP enforce device restrictions for different hardware categories on Windows clients?

A. Through user-level policies defined at the SEPM server B. By monitoring system event logs for unauthorized devices C. Using Active Directory group policies D. Via class-level or device ID-level rules defined in Device Control policy

Correct Answer: D

Question 6

When importing an Organizational Unit (OU) from Active Directory into SEPM, what is the expected behavior?

A. OU import automatically generates GPOs in AD B. The OU structure is converted into client groups C. Only disabled user accounts are imported D. Imported users can log in to SEPM directly

Correct Answer: B

Question 7

Which policy component includes lists of approved applications that are allowed to run on client computers?

A. Host Group Lists B. Approved Application Lists C. Allow Lists D. File Fingerprint Lists

Correct Answer: D

Question 8

What file extension is commonly used for manual installation of virus definitions into SEPM?

A. .jdb B. .vdb C. .sar D. .zip

Correct Answer: A

Question 9

Which two report types in SEPM help monitor virus and spyware activity across Windows clients?
(Choose two)

A. Logon Failure Report B. Device Control Events C. Infected Files by Source D. Risk Distribution Summary

Correct Answer: C,D

Question 10

What are two benefits of using SEP Device Control in a corporate security strategy?
(Choose two)

A. Prevents unauthorized data exfiltration via USB storage B. Encrypts USB devices with a hardware-level certificate C. Ensures compliance with data protection policies D. Automatically blocks malicious URLs

Correct Answer: A,C

Question 11

Which key data points are typically included in an SEDR incident report?

A. SEP license keys B. Endpoint memory usage logs C. SEPM patch version history D. Involved endpoints, threat severity, and suggested actions

Correct Answer: D

Question 12

Which two settings must be configured to forward SEDR events to an external SIEM system?
(Choose two)

A. Select the Update Server from SEPM B. Enable syslog transmission C. Install LiveUpdate Administrator D. Define destination IP and port for the SIEM

Correct Answer: B,D

Question 13

What best describes a core installation consideration for the SEDR appliance?

A. It should be sized and placed to minimize latency from SEP clients B. It can only be installed on Windows Server 2022 C. It must be installed on the same machine as SEPM D. It requires a public IP for direct internet updates

Correct Answer: A

Symantec Endpoint Protection 14.x Admin R2 Technical Specialist - 250-605 Exam Practice Test