250-580 by Symantec Actual Free Exam Questions And Answers

Question 1

What are the two (2) locations where an Incident Responder should gather data for an After Actions Report in SEDR? (Select two)

A. Policies

B. Incident Manager

C. Action Manager

D. Syslog

E. Endpoint Search

Discussion 0

Correct Answer: B,D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 2

An organization recently experienced an outbreak and is conducting a health check of the environment. What Protection Technology can the SEP team enable to control and monitor the behavior of applications?

A. System Lockdown

B. Host Integrity

C. Behavior Monitoring (SONAR)

D. Application Control

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 3

How are Insight results stored?

A. Encrypted on the Symantec Endpoint Protection Manager

B. Unencrypted on the Symantec Endpoint Protection client

C. Unencrypted on the Symantec Endpoint Protection Manager

D. Encrypted on the Symantec Endpoint Protection client

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 4

What Threat Defense for Active Directory feature disables a process's ability to spawn another process, overwrite a part of memory, run recon commands, or communicate to the network?

A. Process Mitigation

B. Process Protection

C. Threat Monitoring

D. Memory Analysis

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 5

Which Incident View widget shows the parent-child relationship of related security events?

A. The Events Widget

B. The Incident Summary Widget

C. The Incident Graph Widget

D. The Process Lineage Widget

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 6

A file has been identified as malicious.
Which feature of SEDR allows an administrator to manually block a specific file hash?

A. Playbooks

B. Allow List

C. Block List

D. Quarantine

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 7

The SES Intrusion Prevention System has blocked an intruder's attempt to establish an IRC connection inside the firewall. Which Advanced Firewall Protection setting should an administrator enable to prevent the intruder's system from communicating with the network after the IPS detection?

A. Enable denial of service detection

B. Automatically block an attacker's IP address

C. Block all traffic until the firewall starts and after the firewall stops

D. Enable port scan detection

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 8

Which other items may be deleted when deleting a malicious file from an endpoint?

A. SEP Policies related to that file

B. Registry entries that point to that file

C. The incident related to the file

D. Files and libraries that point to that file

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Symantec Endpoint Security Complete - Administration R2 - 250-580 Exam Practice Test

Contact Us

Useful Links

Latest Updated