Symantec Symantec Certifications 250-428 Questions & Answers

• Question 141:

  Which step is unnecessary when an administrator creates an application rule set?

  A. define a provider

  B. select a process to apply

  C. select a process to exclude

  D. define rule order

  Correct Answer: A

• Question 142:

  Where can an administrator obtain the Sylink.xml file?

  A. C:\Program Files\Symantec\Symantec Endpoint Protection\ folder on the client

  B. C:\Program Files\Symantec\Symantec Endpoint Protection\Manager\data\inbox\agent\ folder on the Symantec Endpoint Protection Manager

  C. by selecting the client group and exporting the communication settings in the Symantec Endpoint Protection Manager Console

  D. by selecting the location and exporting the communication settings in the Symantec Endpoint Protection Manager Console

  Correct Answer: C

• Question 143:

  Which action should an administrator take to prevent users from using Windows Security Center?

  A. Set Disable antivirus alert within Windows Security Center to Disable

  B. Set Disable Windows Security Center to Always

  C. Set Disable Windows Security Center to Disable

  D. Set Disable antivirus alert within Windows Security Center to Never

  Correct Answer: B

• Question 144:

  A Symantec Endpoint Protection (SEP) client uses a management server list with three management servers in the priority 1 list.

  Which mechanism does the SEP client use to select an alternate management server if the currently selected management server is unavailable?

  A. The client chooses the next server alphabetically by server name.

  B. The client chooses another server alphabetically in the list randomly.

  C. The client chooses a server with the next highest IP address.

  D. The client chooses a server based on the lowest server load.

  Correct Answer: B

• Question 145:

  Which command attempts to find the name of the drive in the private region and to match it to a disk media record that is missing a disk access record?

  A. vxdisk

  B. vxdctl

  C. vxreattach

  D. vxrecover

  Correct Answer: C

• Question 146:

  An administrator plans to implement a multi-site Symantec Endpoint Protection (SEP) deployment. The administrator needs to determine whether replication is viable without having to make network firewall changes or change defaults in SEP.

  Which port should the administrator verify is open on the path of communication between the two proposed sites? (Type the port number.)

  A. 8443

  Correct Answer: A

• Question 147:

  Which action must a Symantec Endpoint Protection administrator take before creating custom Intrusion Prevention signatures?

  A. Change the custom signature order

  B. Create a Custom Intrusion Prevention Signature library

  C. Define signature variables

  D. Enable signature logging

  Correct Answer: B

  References: https://support.symantec.com/en_US/article.HOWTO80877.html

• Question 148:

  Where in the Symantec Endpoint Protection (SEP) management console will a SEP administrator find the option to allow all users to enable and disable the client firewall?

  A. Client User Interface Control Settings

  B. Overview in Firewall Policy

  C. Settings in Intrusion Prevention Policy

  D. System Lockdown in Group Policy

  Correct Answer: A

  Reference: https://www.symantec.com/connect/forums/disable-protection-endpoint-protection-manager

• Question 149:

  In the virus and Spyware Protection policy, an administrator sets the First action to Clean risk and sets If first action fails to Delete risk. Which two factors should the administrator consider? (Select two.)

  A. The deleted file may still be in the Recycle Bin.

  B. IT Analytics may keep a copy of the file for investigation.

  C. False positives may delete legitimate files.

  D. Insight may back up the file before sending it to Symantec.

  E. A copy of the threat may still be in the quarantine.

  Correct Answer: CE

• Question 150:

  A Symantec Endpoint Protection administrator must block traffic from an attacking computer for a specific time period. Where should the administrator adjust the time to block the attacking computer?

  A. in the firewall policy, under Protection and Stealth

  B. in the firewall policy, under Built in Rules

  C. in the group policy, under External Communication Settings

  D. in the group policy, under Communication Settings

  Correct Answer: A