250-441 Online Practice Questions and Answers

What is the role of Insight within the Advanced Threat Protection (ATP) solution?

A. Reputation-based security

B. Detonation/sandbox

C. Network detection component

D. Event correlation

Why is it important for an Incident Responder to analyze an incident during the Recovery phase?

A. To determine the best plan of action for cleaning up the infection

B. To isolate infected computers on the network and remediate the threat C. To gather threat artifacts and review the malicious code in a sandbox environment

D. To access the current security plan, adjust where needed, and provide reference materials in the event of a similar incident

What is the role of Cynic within the Advanced Threat Protection (ATP) solution?

A. Reputation-based security

B. Event correlation

C. Network detection component

D. Detonation/sandbox

How should an ATP Administrator configure Endpoint Detection and Response according to Symantec best practices for a SEP environment with more than one domain?

A. Create a unique Symantec Endpoint Protection Manager (SEPM) domain for ATP

B. Create an ATP manager for each Symantec Endpoint Protection Manager (SEPM) domain

C. Create a Symantec Endpoint Protection Manager (SEPM) controller connection for each domain

D. Create a Symantec Endpoint Protection Manager (SEPM) controller connection for the primary domain

What occurs when an endpoint fails its Host Integrity check and is unable to remediate?

A. The endpoint automatically switches to using a Compliance location, where a Compliance policy is applied to the computer.

B. The endpoint automatically switches to using a System Lockdown location, where a System Lockdown policy is applied to the computer.

C. The endpoint automatically switches to using a Host Integrity location, where a Host Integrity policy is applied to the computer.

D. The endpoint automatically switches to using a Quarantine location, where a Quarantine policy is applied to the computer.

An Incident Responder observes an incident with multiple malware downloads from a malicious domain. The domain in question belongs to one of the organization's suppliers. The organization needs access to the site to continue placing orders. ATP: Network is configured in Inline Block mode.

How should the Incident Responder proceed?

A. Whitelist the domain and close the incident as a false positive

B. Identify the pieces of malware and blacklist them, then notify the supplier

C. Blacklist the domain and IP of the attacking site

D. Notify the supplier and block the site on the external firewall

Which default port does ATP use to communicate with the Symantec Endpoint Protection Manager (SEPM) web services?

A. 8446

B. 8081

C. 8014

D. 1433

Which two actions can an Incident Responder take in the Cynic portal? (Choose two.)

A. Configure a SIEM feed from the portal to the ATP environment

B. Configure email reports on convictions

C. Submit false positive and false negative files

D. Query hashes

E. Submit hashes to Insight

Which service is the minimum prerequisite needed if a customer wants to purchase ATP: Email?

A. Email Protect (antivirus and anti-spam)

B. Email Safeguard (antivirus, anti-spam, encryption, data protection and image control)

C. Symantec Messaging Gateway

D. Skeptic

What are the prerequisite products needed when deploying ATP: Endpoint, Network, and Email?

A. SEP and Symantec Messaging Gateway

B. SEP, Symantec Email Security.cloud, and Security Information and Event Management (SIEM)

C. SEP and Symantec Email Security.cloud

D. SEP, Symantec Messaging Gateway, and Symantec Email Security.cloud