250-580 Endpoint Security Complete - R2 Technical Specialist Exam Dumps - Free Latest Dumps for IT Certification Exams

250-580 Endpoint Security Complete – R2 Technical Specialist Exam Dumps

dumps2024-11-29T11:10:22+08:00

250-580 Endpoint Security Complete – R2 Technical Specialist exam is easy for you to pass now. Learning 250-580 exam information is a first step for you to prepare for the test well. There are 150 questions in real Broadcom certification 250-580 exam, and you have 180 minutes to complete the test. The requried passing score is 70%. The available language is English. The exam price is $250. We provide the latest Endpoint Security Complete – R2 Technical Specialist 250-580 exam dumps, which can make sure you pass the test easily. Free Endpoint Security Complete – R2 Technical Specialist 250-580 exam dumps are available below.

Page 1 of 5

1. What EDR function minimizes the risk of an endpoint infecting other resources in the environment?

Quarantine

Block

Deny List

Firewall

2. What priority would an incident that may have an impact on business be considered?

Low

Critical

High

Medium

3. Which antimalware intensity level is defined by the following: "Blocks files that are most certainly bad or potentially bad files results in a comparable number of false positives and false negatives."

Level 6

Level 5

Level 2

Level 1

4. The SES Intrusion Prevention System has blocked an intruder's attempt to establish an IRC connection inside the firewall.

Which Advanced Firewall Protection setting should an administrator enable to prevent the intruder's system from communicating with the network after the IPS detection?

Enable port scan detection

Automatically block an attacker's IP address

Block all traffic until the firewall starts and after the firewall stops

Enable denial of service detection

5. After several failed logon attempts, the Symantec Endpoint Protection Manager (SEPM) has locked the default admin account. An administrator needs to make system changes as soon as possible to address an outbreak, but the admin account is the only account.

Which action should the administrator take to correct the problem with minimal impact on the existing environment?

Wait 15 minutes and attempt to log on again

Restore the SEPM from a backup

Run the Management Server and Configuration Wizard to reconfigure the server

Reinstall the SEPM

6. Which Incident View widget shows the parent-child relationship of related security events?

The Incident Summary Widget

The Process Lineage Widget

The Events Widget

The Incident Graph Widget

7. Which Symantec Endpoint Protection technology blocks a downloaded program from installing browser plugins?

Intrusion Prevention

SONAR

Application and Device Control

Tamper Protection

8. Which type of event does operation:1 indicate in a SEDR database search?

File Deleted.

File Closed.

File Open.

File Created.

9. An Incident Responder has determined that an endpoint is compromised by a malicious threat.

What SEDR feature would be utilized first to contain the threat?

File Deletion

Incident Manager

Isolation

Endpoint Activity Recorder

10. If an administrator enables the setting to manage policies from the cloud, what steps must be taken to reverse this process?

Navigate to ICDm > Enrollment and disable the setting

Unenroll the SEPM > Disable the setting > Re-enroll the SEPM

Revoke policies from ICDm

Revoke policies from SEPM

Page 2 of 5

11. How would an administrator specify which remote consoles and servers have access to the management server?

Edit the Server Properties and under the General tab, change the Server Communication Permission.

Edit the Communication Settings for the Group under the Clients tab.

Edit the External Communication Settings for the Group under the Clients tab.

Edit the Site Properties and under the General tab, change the server priority.

12. Which designation should an administrator assign to the computer configured to find unmanaged devices?

Discovery Device

Discovery Manager

Discovery Agent

Discovery Broker

13. An administrator notices that some entries list that the Risk was partially removed. The administrator

needs to determine whether additional steps are necessary to remediate the threat.

Where in the Symantec Endpoint Protection Manager console can the administrator find additional information on the risk?

Risk log

Computer Status report

Notifications

Infected and At-Risk Computers report

14. Which Endpoint Setting should an administrator utilize to locate unmanaged endpoints on a network subnet?

Device Discovery

Endpoint Enrollment

Discover and Deploy

Discover Endpoints

15. Why is it important for an Incident Responder to copy malicious files to the SEDR file store or create an image of the infected system during the Recovery phase?

To create custom IPS signatures

To test the effectiveness of the current assigned policy settings in the Symantec Endpoint Protection Manager (SEPM)

To have a copy of the file for policy enforcement

To document and preserve any pieces of evidence associated with the incident

16. An administrator changes the Virus and Spyware Protection policy for a specific group that disables Auto-Protect. The administrator assigns the policy and the client systems apply the corresponding policy serial number. Upon visual inspection of a physical client system, the policy serial number is correct. However, Auto-Protect is still enabled on the client system.

Which action should the administrator take to ensure that the desired setting is in place for the client?

Restart the client system

Run a command on the computer to Update Content

Enable the padlock next to the setting in the policy

Withdraw the Virus and Spyware Protection policy

17. In the virus and Spyware Protection policy, an administrator sets the First action to Clean risk and sets If first action fails to Delete risk.

Which two (2) factors should the administrator consider? (Select two.)

The deleted file may still be in the Recycle Bin.

IT Analytics may keep a copy of the file for investigation.

False positives may delete legitimate files.

Insight may back up the file before sending it to Symantec.

A copy of the threat may still be in the quarantine.

18. What protection technology should an administrator enable to prevent double executable file names of ransomware variants like Cryptolocker from running?

Download Insight

Intrusion Prevention System

SONAR

Memory Exploit Mitigation

19. Which Indicator of Compromise might be detected as variations in the behavior of privileged users that indicate that their account is being used by someone else to gain a foothold in an environment?

Mismatched Port - Application Traffic

Irregularities in Privileged User Account Activity

Surges in Database Read Volume

Geographical Irregularities

20. Why is Active Directory a part of nearly every targeted attack?

AD administration is managed by weak legacy APIs.

AD is, by design, an easily accessed flat file name space directory database

AD exposes all of its identities, applications, and resources to every endpoint in the network

AD user attribution includes hidden elevated admin privileges

Page 3 of 5

21. Which technology can prevent an unknown executable from being downloaded through a browser session?

Intrusion Prevention

Insight

Application Control

Advanced Machine Learning

22. What should an administrator know regarding the differences between a Domain and a Tenant in ICDm?

A tenant can contain multiple domains

Each customer can have one domain and many tenants

A domain can contain multiple tenants

Each customer can have one tenant and no domains

23. Which type of file attribute is valid for creating a block list entry with Symantec Endpoint Detection and Response (SEDR)?

SHA256

Type

Date Created

Filename

24. Which SES feature helps administrators apply policies based on specific endpoint profiles?

Policy Bundles

Device Profiles

Policy Groups

Device Groups

25. What should an administrator utilize to identify devices on a Mac?

Use DevViewer when the Device is connected.

Use Devicelnfo when the Device is connected.

Use Device Manager when the Device is connected.

Use GatherSymantecInfo when the Device is connected.

26. What is an appropriate use of a file fingerprint list?

Allow unknown files to be downloaded with Insight

Prevent programs from running

Prevent Antivirus from scanning a file

Allow files to bypass Intrusion Prevention detection

27. What is the purpose of a Threat Defense for Active Directory Deceptive Account?

It prevents attackers from reading the contents of the Domain Admins Group.

It assigns a fake NTLM password hash value for users with an assigned AdminCount attribute.

It exposes attackers as they seek to gather credential information from workstation memory.

It acts as a honeypot to expose attackers as they attempt to build their AD treasure map

28. When are events generated within SEDR?

When an incident is selected

When an activity occurs

When any event is opened

When entities are viewed

29. What tool can administrators use to create custom behavioral isolation policies based on collected application behavior data?

Behavioral Prevalence Check

Behavioral Heat Map

Application Catalog

Application Frequency Map

30. A file has been identified as malicious.

Which feature of SEDR allows an administrator to manually block a specific file hash?

Playbooks

Quarantine

Allow List

Block List

Page 4 of 5

31. How does IPS check custom signatures?

IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine continues checking for other signatures.

IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine restarts checking for signatures.

IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine stops checking other signatures.

IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine logs the other signatures.

32. An Application Control policy includes an Allowed list and a Blocked list. A user wants to use an application that is neither on the Allowed list nor on the Blocked list.

What can the user do to gain access to the application?

Email the App Control Admin

Request an Override

Install the application

Wait for the Application Drift process to complete

33. What does an end-user receive when an administrator utilizes the Invite User feature to distribute the SES client?

An email with the SES_setup.zip file attached

An email with a link to register on the ICDm user portal

An email with a link to directly download the SES client

An email with a link to a KB article explaining how to install the SES Agent

34. An organization identifies a threat in its environment and needs to limit the spread of the threat.

How should the SEP Administrator block the threat using Application and Device Control?

Gather the MD5 hash of the file and create an Application Content Rule that blocks the file based on the file fingerprint.

Gather the process name of the file and create an Application Content Rule that blocks the file based on the device ID type.

Gather the MD5 hash of the file and create an Application Content Rule that uses regular expression matching.

Gather the MD5 hash of the file and create an Application Content Rule that blocks the file based on specific arguments.

35. What EDR feature provides endpoint activity recorder data for a file hash?

Process Dump

Entity Dump

Hash Dump

Full Dump

36. What Symantec Best Practice is recommended when setting up Active Directory integration with the Symantec Endpoint Protection Manager?

Ensure there is more than one Active Directory Server listed in the Server Properties.

Link the built-in Admin account to an Active Directory account.

Import the existing AD structure to organize clients in user mode.

Secure the management console by denying access to certain computers.

37. Which SES security control protects a user against data leakage if they encounter a man-in-the-middle attack?

IPv6 Tunneling

IPS

Firewall

VPN

38. What happens when an administrator adds a file to the deny list?

The file is assigned to a chosen Deny List policy

The file is assigned to the Deny List task list

The file is automatically quarantined

The file is assigned to the default Deny List policy

39. What is a feature of Cynic?

Local Sandboxing

Forwarding event data to Security Information and Event Management (SIEM)

Cloud Sandboxing

Customizable OS Images

40. Which IPS signature type is primarily used to identify specific unwanted network traffic?

Attack

Audit

Malcode

Probe

Page 5 of 5

41. Which SES advanced feature detects malware by consulting a training model composed of known good and known bad files?

Signatures

Reputation

Artificial Intelligence

Advanced Machine Learning

42. Files are blocked by hash in the deny list policy.

Which algorithm is supported, in addition to MD5?

SHA2

SHA256

SHA256 "salted"

MD5 "Salted"

43. What is the function of Symantec Insight?

Provides reputation ratings for structured data

Enhances the capability of Group Update Providers (GUP)

Increases the efficiency and effectiveness of LiveUpdate

Provides reputation ratings for binary executables

44. What does a ranged query return or exclude?

Data matching the exact field names and their values

Data matching a regular expression

Data falling between two specified values of a given field

Data based on specific values for a given field

45. Which type of security threat continues to threaten endpoint security after a system reboot?

file-less

memory attack

script

Rootkit

250-580 Endpoint Security Complete – R2 Technical Specialist Exam Dumps

250-580 Endpoint Security Complete – R2 Technical Specialist Exam Dumps

Share this post