250-428 Administration of Symantec Endpoint Protection 14 Questions and Answers

A company allows users to create firewall rules. During the course of business, users are accidentally adding rules that block a custom internal application.

Which steps should the Symantec Endpoint Protection administrator take to prevent users from blocking the custom application?

Which tool should an administrator use to discover and deploy the Symantec Endpoint Protection client to new computers?

What does SONAR use to reduce false positives?

An administrator notices that some entries list that the Risk was partially removed. The administrator needs to determine whether additional steps are necessary to remediate the threat.

Where in the Symantec Endpoint Protection Manager console can the administrator find additional information on the risk?

An organization needs to add a collection of DNS host names to permit in the firewall policy.

How Should the SEP Administrator add these DNS host names as a single rule in the firewall policy?

Which setting can an administrator change that will result in the greatest impact on the speed of delivery of Symantec Endpoint Protection policy changes to the endpoints?

A Symantec Endpoint Protection administrator needs to comply with a service level agreement stipulating that all definitions must be internally quality assurance tested before being deployed to customers.

Which step should the administrator take?

A large software company runs a small engineering department that is remotely located over a slow WAN connection.

Which option should the company use to install an exported Symantec Endpoint Protection (SEP) package to the remote site using the smallest amount of network bandwidth?

Which command attempts to find the name of the drive in the private region and to match it to a disk media record that is missing a disk access record?

A Symantec Endpoint Protection (SEP) client uses a management server list with three management servers in the priority 1 list.

Which mechanism does the SEP client use to select an alternate management server if the currently selected management server is unavailable?

Which Symantec Endpoint Protection technology blocks a downloaded program from installing browser plugins?

A user is unknowingly about to connect to a malicious website and download a known threat within a .rar file. All Symantec Endpoint Protection technologies are installed on the client ' s system.

In which feature set order must the threat pass through to successfully infect the system?

An organization is troubleshooting a false positive detection with WS.Respulation.1 Signature on an unmanaged SEP client.

What are the steps to create an exclusion on the unmanaged SEP Client?

Which Symantec Endpoint Protection defense mechanism provides protection against threats that propagate from system to system through the use of autorun.inf files?

Which step is unnecessary when an administrator creates an application rule set?

Which two are policy types within the Symantec Endpoint Protection Manager? (Select two.)

Why is Notepad unable to save the changes to the file in the image below?

An administrator is unable to delete a location.

What is the likely cause?

A threat was detected by Auto-Protect on a client system.

Which command can an administrator run to determine whether additional threats exist?

Which object in the Symantec Endpoint Protection Manager console describes the most granular level to which a policy can be assigned?

An organization recently experienced a definition storm where clients downloaded full definition packages from the management server.

Where can the SEPM increase the amount of content revisions so that clients with older content can get delta updates?

What report should a SEP administrator utilize to verify that Clients are connected to the management server?

An organization has several remote location with minimum bandwidth and would like to use a content distribution method that does NOT involve configuring as internal LiveUpdate server.

What content distribution method should be utilized?

An administrator configures the scan duration for a scheduled scan. The scan fails to complete in the specified time period.

When will the next scheduled scan occur on the computer?

Where can an administrator obtain the Sylink.xml file?

What is a valid Symantec Endpoint Protection (SEP) single site design?

Administrators at a company share a single terminal for configuring Symantec Endpoint Protection. The administrators want to ensure that each administrator using the console is forced to authenticate using their individual credentials. They are concerned that administrators may forget to log off the terminal, which would easily allow others to gain access to the Symantec Endpoint Protection Manager (SEPM) console.

Which setting should the administrator disable to minimize the risk of non-authorized users logging into the SEPM console?

A company deploys Symantec Endpoint Protection (SEP) to50 virtual machines running on a single ESXi host.

Which configuration change can the administrator make to minimize sudden IOPS impact on the ESXi server while each SEP endpoint communicates with the Symantec Endpoint Protection Manager?

Which two criteria should an administrator use when defining Location Awareness for the Symantec Endpoint Protection (SEP) client? (Select two.)

A Symantec Endpoint Protection Manager (SEPM) administrator notices performance issues with the SEPM server. The Client tab becomes unresponsive in the SEPM console and .DAT files accumulate in the “agentinfo” folder.

Which tool should the administrator use to gather log files to submit to Symantec Technical Support?

A Symantec Endpoint Protection administrator must block traffic from an attacking computer for a specific time period.

Where should the administrator adjust the time to block the attacking computer?

An administrator changes the Virus and Spyware Protection policy for a specific group that disables Auto-Protect. The administrator assigns the policy and the client systems apply the corresponding policy serial number. Upon visual inspection of a physical client system, the policy serial number is correct. However, Auto-Protect is still enabled on the client system.

Which action should the administrator take to ensure that the desired setting is in place on the client?

A financial company enforces a security policy that prevents banking system workstations from connecting to the Internet.

Which Symantec Endpoint Protection technology is ineffective on this company ' s workstations?

An administrator is troubleshooting a Symantec Endpoint Protection (SEP) replication.

Which component log should the administrator check to determine whether the communication between the two sites is working correctly?

Which feature reduces the impact of Auto-Protect on a virtual client guest operating system?

The LiveUpdate Download Schedule is set to the default on the Symantec Endpoint Protection Manager (SEPM).

How many content revisions must the SEPM keep to ensure clients that check in to the SEPM every 10 days receive delta content packages instead of full content packages?

Why does Power Eraser need Internet access?