250-441: Administration of Symantec Advanced Threat Protection 3.0

Why is it important for an Incident Responder to analyze an incident during the Recovery phase?

To determine the best plan of action for cleaning up the infection
To isolate infected computers on the network and remediate the threat
To gather threat artifacts and review the malicious code in a sandbox environment
To access the current security plan, adjust where needed, and provide reference materials in the event of a similar incident

Correct answer: D

Which two database attributes are needed to create a Microsoft SQL SEP database connection? (Choose two.)

Database version
Database IP address
Database domain name
Database hostname
Database name

Correct answer: BD

How does an attacker use a zero-day vulnerability during the Incursion phase?

To perform a SQL injection on an internal server
To extract sensitive information from the target
To perform network discovery on the target
To deliver malicious code that breaches the target

Correct answer: D

Explanation:

Reference: https://www.symantec.com/connect/blogs/guide-zero-day-exploits

Why is it important for an Incident Responder to review Related Incidents and Events when analyzing an incident for an After Actions Report?

It ensures that the Incident is resolved, and the responder can clean up the infection.
It ensures that the Incident is resolved, and the responder can determine the best remediation method.
It ensures that the Incident is resolved, and the threat is NOT continuing to spread to other parts of the environment.
It ensures that the Incident is resolved, and the responder can close out the incident in the ATP manager.

Correct answer: C

Which best practice does Symantec recommend with the Endpoint Detection and Response feature?

Create a unique Cynic account to provide to ATP
Create a unique Symantec Messaging Gateway account to provide to ATP
Create a unique Symantec Protection Manager (SEPM) administrator account to provide to ATP
Create a unique Email Security.cloud portal account to provide to ATP

Correct answer: C

What is the role of Cynic within the Advanced Threat Protection (ATP) solution?

Reputation-based security
Event correlation
Network detection component
Detonation/sandbox

Correct answer: D

Explanation:

Reference: https://www.symantec.com/content/en/us/enterprise/fact_sheets/b-advanced-threat-protection-email-DS-21349610.pdf

Which section of the ATP console should an ATP Administrator use to create blacklists and whitelists?

Reports
Settings
Action Manager
Policies

Correct answer: D

Explanation:

Reference: https://symwisedownload.symantec.com//resources/sites/SYMWISE/content/live/DOCUMENTATION/10000/DOC10986/en_US/satp_administration_guide_3.1.pdf?__gda__=1541979133_5668f0b4c03c16ac1a30d54989313e76 (132)

How should an ATP Administrator configure Endpoint Detection and Response according to Symantec best practices for a SEP environment with more than one domain?

Create a unique Symantec Endpoint Protection Manager (SEPM) domain for ATP
Create an ATP manager for each Symantec Endpoint Protection Manager (SEPM) domain
Create a Symantec Endpoint Protection Manager (SEPM) controller connection for each domain
Create a Symantec Endpoint Protection Manager (SEPM) controller connection for the primary domain

Correct answer: C

Explanation:

Reference: https://symwisedownload.symantec.com//resources/sites/SYMWISE/content/live/DOCUMENTATION/10000/DOC10986/en_US/satp_administration_guide_3.1.pdf?__gda__=1541979133_5668f0b4c03c16ac1a30d54989313e76 (46)

Which attribute is required when configuring the Symantec Endpoint Protection Manager (SEPM) Log Collector?

SEPM embedded database name
SEPM embedded database type
SEPM embedded database version
SEPM embedded database password

Correct answer: D

Explanation:

Reference: https://support.symantec.com/en_US/article.HOWTO125960.html

An Incident Responder wants to run a database search that will list all client named starting with SYM.

Which syntax should the responder use?

hostname like “SYM”
hostname “SYM”
hostname “SYM*”
hostname like “SYM*”

Correct answer: A

Explanation:

Reference: https://support.symantec.com/en_US/article.HOWTO124805.html

Vendor:	Symantec
Exam Code:	250-441
Exam Name:	Administration of Symantec Advanced Threat Protection 3.0
Date:	Nov 16, 2018
File Size:	24 KB

Download Administration of Symantec Advanced Threat Protection 3.0.250-441.PassCertification.2018-11-16.42q.vcex

How to open VCEX files?

Demo Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

ProfExam at a 20% markdown