Symantec 250-441 問題集

質問 1：
Which threat is an example of an Advanced Persistent Threat (APT)?
A. ZeroAccess
B. Michelangelo
C. Aurora
D. Loyphish
正解：C

質問 2：
Which access credentials does an ARP Administrator need to set up a deployment of ATP: Endpoint , Network and Email?
A. Active Directory logging to the Symantec endpoint Protection Manager (SEPM) database and an Email Security. Cloud login with full access
B. Email security. Cloud credential for email correlation, credential for the Symantec Endpoint Protection Manager (SEPM) database, and System Administrator logging for the SEPM.
C. Symantec Endpoint protection Manager (SEPM) login and ATP: Email login with service permissions
D. Credentials for the Symantec Endpoint protection Manager (SEPM) database, and an administrator loging or Symantec Messaging Gateway
正解：B

質問 3：
An Incident Responder notices traffic going from an endpoint to an IRC channel. The endpoint is listed in an incident. ATP is configured in TAP mode.
What should the Incident Responder do to stop the traffic to the IRC channel?
A. Blacklist the IRC channel IP
B. Isolate the endpoint with a Quarantine Firewall policy
C. Blacklist the endpoint IP
D. Isolate the endpoint with an application control policy
正解：C

質問 4：
Which level of privilege corresponds to each ATP account type?
Match the correct account type to the corresponding privileges.

正解：



質問 5：
Which National Institute of Standards and Technology (NIST) cybersecurity function includes Risk Assessment or Risk Management Strategy?
A. Respond
B. Recover
C. Protect
D. Identify
正解：D

質問 6：
An Incident Responder wants to use a STIX file to run an indicate of components (IOC) search.
Which format must the administrator use for the file?
A. .html
B. .xml
C. .mht
D. .csv
正解：B

質問 7：
An Incident Responder wants to create a timeline for a recent incident using Syslog in addition to ATP for the After Actions Report.
What are two reasons the responder should analyze the information using Syslog? (Choose two.)
A. To determine what policy settings to modify in the Symantec Endpoint Protection Manager (SEPM)
B. To determine the best cleanup method
C. To evaluate the data, including information from other systems
D. To have less raw data to analyze
E. To access expanded historical data
正解：B,C

質問 8：
In which scenario should an Incident Responder manually submit a file to the Cynic portal?
A. There is a file on a USB that an Incident Responder wants to analyze in a sandbox.
B. The file has generated multiple incidents in the ATP manager and an Incident Responder wants to blacklist the file.
C. The file is a legitimate application and an Incident Responder wants to report it to Symantec as a false positive.
D. An Incident Responder is unable to remember the password to the .zip archive.
正解：C