250-604 by Broadcom Actual Free Exam Q&As

Question 1

What update type is delivered to endpoints to ensure the latest threat intelligence is applied?

A. Feature Release B. Content Update C. OS Patch D. Policy Bundle

Discussion 0

Correct Answer: B Vote an answer

Question 2

Which two types of policy adaptations are possible using SES Complete behavior-based policy tuning? (Choose two)

A. Whitelisting internal tools that show abnormal behavior B. Blocking applications that do not match expected behavior C. Changing device group names based on alert severity D. Automatically uninstalling legacy applications

Discussion 0

Correct Answer: A,B Vote an answer

Question 3

What is the primary function of Network Integrity Policy Configuration in ICDm?

A. Defining detection and mitigation rules for mobile network threats B. Disabling Bluetooth pairing C. Controlling CPU usage on mobile devices D. Restricting device roaming

Discussion 0

Correct Answer: A Vote an answer

Question 4

Which policy feature can assist in tracking changes over time and debugging misconfigurations?

A. Policy version history B. Content sync monitoring C. Endpoint tagging D. Logging level adjustment

Discussion 0

Correct Answer: A Vote an answer

Question 5

You are a security analyst managing SES Complete via ICDm. A ransomware attack is detected on several endpoints.
What actions should you take in ICDm to mitigate the impact and prevent further spread? (Choose three)

A. Enable LiveShell to run a process scan B. Quarantine the affected endpoints C. Send a compliance reminder to all users D. Generate an administrative report for incident tracking E. Run a full policy sync on all endpoints

Discussion 0

Correct Answer: A,B,D Vote an answer

Question 6

Using the ICDm console, a SES administrator issues a device command. When will the command be executed on the endpoint?

A. When the user is idle B. At the next heartbeat C. Immediately D. When the endpoint reboots

Discussion 0

Correct Answer: C Vote an answer

Question 7

What must be considered when configuring policy precedence in a hybrid setup with SEPM and ICDm?

A. The first applied policy becomes permanent unless manually changed B. SEPM always overrides ICDm policies C. ICDm policies take precedence over SEPM when both are active D. Only one policy type is allowed per site

Discussion 0

Correct Answer: C Vote an answer

Question 8

Why is it important to configure and deploy the Threat Defense for Active Directory policy after successful installation?

A. It ensures the detection engine is synchronized with mobile threat prevention. B. It enables logging of all user profile access attempts on all endpoints. C. It activates the security monitoring rules necessary for identifying lateral movement and AD abuse. D. It registers endpoints as DNS relay hosts to enhance auditing capability.

Discussion 0

Correct Answer: C Vote an answer

Question 9

What condition must be met to successfully enable Application Control within the ICDm console to begin implementing attack surface reduction policies?

A. A valid policy group must be selected for deployment. B. Endpoints must be connected to the internal network via Ethernet. C. Admin roles must be set to "Audit Mode" for App Control. D. All endpoints must have Intel TPM 2.0 enabled.

Discussion 0

Correct Answer: A Vote an answer

Question 10

Which situation would justify enabling LiveShell for a particular endpoint within EDR?

A. A threat was found that requires live command-line investigation B. The endpoint must be moved to a guest network C. The endpoint is being reformatted D. The endpoint requires reboot

Discussion 0

Correct Answer: A Vote an answer

Question 11

What primary advantage does EDR offer over standard antivirus capabilities in Symantec Endpoint Security Complete?

A. It runs without user interaction B. It installs faster and requires less disk space C. It provides behavioral analytics and historical activity tracking beyond signature detection D. It offers discounted licensing bundles

Discussion 0

Correct Answer: C Vote an answer

Question 12

Which two capabilities does EDR offer to help analysts identify malicious activity on endpoints? (Choose two)

A. Encrypted file transfer monitoring B. Integration with Active Directory GPOs C. Behavioral telemetry from the Endpoint Activity Recorder D. Interactive investigation using LiveShell

Discussion 0

Correct Answer: C,D Vote an answer

Question 13

What does the 'quarantine endpoint' action accomplish within the EDR workflow?

A. Disables Windows Defender permanently B. Restricts the endpoint's ability to communicate on the network C. Formats the hard drive and removes user data D. Moves the endpoint to a less secure location

Discussion 0

Correct Answer: B Vote an answer

Broadcom Symantec Endpoint Security Complete Admin R1.4 Technical Specialist - 250-604 Exam Practice Test