Symantec 250-441 問題集

質問 1：
An ATP administrator is setting up an Endpoint Detection and Response connection.
Which type of authentication is allowed?
A. LDAP authentication
B. SQL authentication
C. Active Directory authentication
D. Symantec Endpoint Protection Manager (SEPM) authentication
正解：C

質問 2：
A customer has information about a malicious file that has NOT entered the network. The customer wants to know whether ATP is already aware of this threat without having to introduce a copy of the file to the infrastructure.
Which approach allows the customer to meet this need?
A. Use the ATP console to check whether the SHA-256 hash triggers a detection from Cynic
B. Use the Cynic portal to check whether the MD5 hash triggers a detection from Cynic
C. Use the Cynic portal to check whether the SHA-256 hash triggers a detection from Cynic
D. Use the ATP console to check whether the MD5 hash triggers a detection from Cynic
正解：D

質問 3：
Which two questions can an Incident Responder answer when analyzing an incident in ATP? (Choose two.)
A. Does the organization need to do a healthcheck in the environment?
B. Do ports need to be blocked or opened on the firewall?
C. Are certain endpoints being repeatedly attacked?
D. Does a risk assessment need to happen in the environment?
E. Is the organization being attacked by this external entity repeatedly?
正解：C,D

質問 4：
Which action should an Incident Responder take to remediate false positives, according to Symantec best practices?
A. Whitelist
B. Blacklist
C. Submit file to Cynic
D. Delete file
正解：A

質問 5：
Which section of the ATP console should an ATP Administrator use to evaluate prioritized threats within the environment?
A. Search
B. Incident Manager
C. Action Manager
D. Events
正解：C

質問 6：
During a recent virus outbreak, an Incident Responder found that the Incident Response team was successful in identifying malicious domains that were communicating with the infected endpoints.
Which two options should the Incident Responder select to prevent endpoints from communicating with malicious domains? (Select two.)
A. Create a firewall rule in the Symantec Endpoint Protection Manager (SEPM) or perimeter firewall that blocks traffic to the domain.
B. Blacklist suspicious domains in the ATP manager.
C. Run a full system scan on all endpoints.
D. Deploy a High-Security Antivirus and Antispyware policy in the Symantec Endpoint Protection Manager (SEPM).
E. Use the isolate command in ATP to move all endpoints to a quarantine network.
正解：A,C

質問 7：
Which Advanced Threat Protection (ATP) component best isolates an infected computer from the network?
A. ATP: Network
B. ATP: Roaming
C. ATP: Email
D. ATP: Endpoint
正解：D

質問 8：
In which two locations should an Incident Responder gather data for an After Actions Report in ATP? (Choose two.)
A. Syslog
B. Incident Manager
C. Action Manager
D. Policies page
E. Indicators of compromise (IOC) search
正解：A,B