Symantec 250-441 問題集

質問 1：
Which level of privilege corresponds to each ATP account type?
Match the correct account type to the corresponding privileges.

正解：



質問 2：
Which two database attributes are needed to create a Microsoft SQL SEP database connection? (Choose two.)
A. Database version
B. Database name
C. Database domain name
D. Database IP address
E. Database hostname
正解：D,E

質問 3：
Where can an Incident Responder view Cynic results in ATP?
A. Dashboard
B. Incident Details
C. File Details
D. Events
正解：B

質問 4：
How can an Incident Responder generate events for a site that was identified as malicious but has NOT triggered any events or incidents in ATP?
A. Assign a High-Security Antivirus and Antispyware policy in the Symantec Endpoint Protection Manager (SEPM).
B. Create a firewall rule in the Symantec Endpoint Protection Manager (SEPM) or perimeter firewall that blocks traffic to the domain.
C. Run an indicators of compromise (IOC) search in ATP manager.
D. Add the site to a blacklist in ATP manager.
正解：D

質問 5：
Which stage of an Advanced Persistent Threat (APT) attack does social engineering occur?
A. Exfiltration
B. Incursion
C. Capture
D. Discovery
正解：B

質問 6：
Which threat is an example of an Advanced Persistent Threat (APT)?
A. Melissa
B. Zeus
C. Duqu
D. Code Red
正解：C

質問 7：
Which best practice does Symantec recommend with the Endpoint Detection and Response feature?
A. Create a unique Symantec Messaging Gateway account to provide to ATP
B. Create a unique Symantec Protection Manager (SEPM) administrator account to provide to ATP
C. Create a unique Email Security.cloud portal account to provide to ATP
D. Create a unique Cynic account to provide to ATP
正解：B

質問 8：
An Incident Responder wants to create a timeline for a recent incident using Syslog in addition to ATP for the After Actions Report.
What are two reasons the responder should analyze the information using Syslog? (Choose two.)
A. To determine what policy settings to modify in the Symantec Endpoint Protection Manager (SEPM)
B. To determine the best cleanup method
C. To evaluate the data, including information from other systems
D. To have less raw data to analyze
E. To access expanded historical data
正解：B,C