250-580 by Symantec Actual Free Exam Q&As

Question 1

Which client log shows that a client is downloading content from its designated source?

A. SesmLu.log B. Risk Log C. System Log D. Log.LiveUpdate

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 2

What is the maximum number of endpoints a single SEDR Manager can support?

A. 200,000 B. 50,000 C. 25,000 D. 100,000

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 3

Why is it important for an Incident Responder to review Related Incidents and Events when analyzing an incident for an After Actions Report?

A. It ensures that the Incident is resolved, and future threats are automatically remediated. B. It ensures that the Incident is resolved, and the threat does not continue to spread to other parts of the environment. C. It ensures that the Incident is resolved, and the responder is able to close the incident in the SEDR manager. D. It ensures that the Incident is resolved, and the responder can determine the best remediation method.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 4

What information is required to calculate retention rate?

A. Number of endpoints, available bandwidth, available disk space, number of endpoint dumps, dump size B. Number of endpoints, available bandwidth, number of days to retain, number of endpoint dumps, dump size C. Number of endpoints, EAR data per endpoint per day, number of days to retain, number of endpoint dumps, dump size D. Number of endpoints, EAR data per endpoint per day, available disk space, number of endpoint dumps, dump size

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 5

An organization recently experienced an outbreak and is conducting a health check of the environment. What Protection Technology can the SEP team enable to control and monitor the behavior of applications?

A. Host Integrity B. Application Control C. System Lockdown D. Behavior Monitoring (SONAR)

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 6

An administrator needs to identify infected computers that require a restart to finish remediation of a threat.
What steps in the SEPM should an administrator perform to identify and restart the systems?

A. View the Computer Status log to determine if any computers require a restart. Run a command from the Attack log to restart computers. B. View the SONAR log to determine if any computers require a restart. Run a command from the Computer Status log to restart computers. C. View the Computer Status log to determine if any computers require a restart. Run a command from the SONAR log to restart computers. D. View the Computer Status log to determine if any computers require a restart. Run a command from the Risk log to restart computers.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 7

What happens when a device fails a Host Integrity check?

A. The device is restarted B. An antimalware scan is initiated C. An administrative notification is logged D. The device is quarantined

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 8

Performance on a SEPM is less than expected and generates intermittent errors. How could the system administrators be notified of performance issues?

A. Add aSystem event alertand specify how often the notifications need to be raised. Specify the e-mail address that needs to be notified and the action when the server health becomes poor. B. Add anAuthentication alertand specify how often the notifications need to be raised. Specify the e- mail address that needs to be notified and the action when the server health becomes poor. C. Add aServer health alertand specify how often the notifications need to be raised. Specify the e-mail address that needs to be notified and the action when the server health becomes poor. D. Add aClient security alertand specify how often the notifications need to be raised. Specify the e-mail address that needs to be notified and the action when the server health becomes poor.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 9

What type of policy provides a second layer of defense, after the Symantec firewall?

A. Host Integrity B. Virus and Spyware C. System Lockdown D. Intrusion Prevention

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 10

An organization has several Symantec Endpoint Protection Management (SEPM) Servers without access to the internet. The SEPM can only run LiveUpdate within a specified "maintenance window" outside of business hours.
What content distribution method should the organization utilize?

A. Internal LiveUpdate B. External LiveUpdate C. Group Update Provider D. JDB file

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 11

What account type must the AD Gateway Service Account be assigned to the AD Gateway device for AD Synchronization to function correctly?

A. Local Administrator B. Domain User C. Local Standard D. Domain Administrator

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 12

If an administrator enables the setting to manage policies from the cloud, what steps must be taken to reverse this process?

A. Navigate to ICDm > Enrollment and disable the setting B. Revoke policies from SEPM C. Unenroll the SEPM > Disable the setting > Re-enroll the SEPM D. Revoke policies from ICDm

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 13

Which two (2) security controls are utilized by an administrator to mitigate threats associated with the Discovery phase? (Select two)

A. Blacklist B. Antimalware C. E.Device Control D. IPS E. Firewall

Discussion 0

Correct Answer: D,E Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 14

A Symantec Endpoint Protection (SEP) client uses a management server list with three management servers in the priority 1 list.
Which mechanism does the SEP client use to select an alternate management server if the currently selected management server is unavailable?

A. The client chooses a server with the next highest IP address. B. The client chooses the next server alphabetically by server name. C. The client chooses another server in the list randomly. D. The client chooses a server based on the lowest server load.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Question 15

What prevention technique does Threat Defense for Active Directory use to expose attackers?

A. Honeypot Traps B. Obfuscation C. Process Monitoring D. Packet Tracing

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Symantec Endpoint Security Complete - Administration R2 - 250-580 Exam Practice Test