Symantec Symantec Certifications 250-441 Questions & Answers

• Question 61:

  In which two locations should an Incident Responder gather data for an After Actions Report in ATP? (Choose two.)

  A. Policies page

  B. Action Manager

  C. Syslog

  D. Incident Manager

  E. Indicators of compromise (IOC) search

  Correct Answer: CD

• Question 62:

  Which action should an Incident Responder take to remediate false positives, according to Symantec best practices?

  A. Blacklist

  B. Whitelist

  C. Delete file

  D. Submit file to Cynic

  Correct Answer: B

  Reference: https://symwisedownload.symantec.com//resources/sites/SYMWISE/content/live/ DOCUMENTATION/10000/DOC10899/en_US/satp_security_ops_guide_3.0.5.pdf? __gda__=1541987119_a3559016c9355c98c2ec53278a8df2a0 (119)

• Question 63:

  Which two widgets can an Incident Responder use to isolate breached endpoints from the Incident details page? (Choose two.)

  A. Affected Endpoints

  B. Dashboard

  C. Incident Graph

  D. Events View

  E. Actions Bar

  Correct Answer: CE

  Reference: https://symwisedownload.symantec.com//resources/sites/SYMWISE/content/live/ DOCUMENTATION/10000/DOC10899/en_US/satp_security_ops_guide_3.0.5.pdf? __gda__=1541987119_a3559016c9355c98c2ec53278a8df2a0 (114)

• Question 64:

  Which threat is an example of an Advanced Persistent Threat (APT)?

  A. Loyphish

  B. Aurora

  C. ZeroAccess

  D. Michelangelo

  Correct Answer: B

• Question 65:

  Which threat is an example of an Advanced Persistent Threat (APT)?

  A. Zeus

  B. Melissa

  C. Duqu

  D. Code Red

  Correct Answer: C

• Question 66:

  How can an Incident Responder generate events for a site that was identified as malicious but has NOT triggered any events or incidents in ATP?

  A. Assign a High-Security Antivirus and Antispyware policy in the Symantec Endpoint Protection Manager (SEPM).

  B. Run an indicators of compromise (IOC) search in ATP manager.

  C. Create a firewall rule in the Symantec Endpoint Protection Manager (SEPM) or perimeter firewall that blocks traffic to the domain.

  D. Add the site to a blacklist in ATP manager.

  Correct Answer: D

  Reference: https://support.symantec.com/en_US/article.HOWTO126023.html

• Question 67:

  An Incident Responder observes an incident with multiple malware downloads from a malicious domain. The domain in question belongs to one of the organization's suppliers. The organization needs access to the site to continue placing orders. ATP: Network is configured in Inline Block mode.

  How should the Incident Responder proceed?

  A. Whitelist the domain and close the incident as a false positive

  B. Identify the pieces of malware and blacklist them, then notify the supplier

  C. Blacklist the domain and IP of the attacking site

  D. Notify the supplier and block the site on the external firewall

  Correct Answer: D

• Question 68:

  Which prerequisite is necessary to extend the ATP: Network solution service in order to correlate email detections?

  A. Email Security.cloud

  B. Web security.cloud

  C. Skeptic

  D. Symantec Messaging Gateway

  Correct Answer: A

  Reference: https://www.symantec.com/content/dam/symantec/docs/data-sheets/endpoint-detection-andresponse-atp-endpoint-en.pdf

• Question 69:

  What does a Quarantine Firewall policy enable an ATP Administrator to do?

  A. Isolate a computer while it is manually being remediated

  B. Submit files to a Central Quarantine server

  C. Filter all traffic leaving the network

  D. Intercept all traffic entering the network

  Correct Answer: A

• Question 70:

  Which threat is an example of an Advanced Persistent Threat (APT)?

  A. Koobface

  B. Brain

  C. Flamer

  D. Creeper

  Correct Answer: C