Exam 1: Administration of Symantec Endpoint Protection 14 (Broadcom)

A customer is downloading newly-created company files from an internal website and is being blocked by Download Insight based on reputation. How can the customer prevent this?

Which setting can an administrator change that will result in the greatest impact on the speed of delivery of Symantec Endpoint Protection policy changes to the endpoints?

Which command attempts to find the name of the drive in the private region and to match it to a disk media record that is missing a disk access record?

A Symantec Endpoint Protection 12.1 (SEP) administrator suspects that newly arrived computers are infected with a virus. Which steps should the administrator take when installing the SEP client on the new computers?

Which tool should an administrator use to discover and deploy the Symantec Endpoint Protection client to new computers?

What is a function of Symantec Insight?

A company is building a new Symantec Endpoint Protection Manager and is setting the remediation actions for threats in the Virus and Spyware Protection policy. For security risks, the first action is set to Repair and the second action is Quarantine. In this environment, Symantec Endpoint Protection 12.1 (SEP) has been deployed to a small group of clients for testing. Which condition would cause Auto-Protect to stop sending notifications and stop logging the event after three detections?

A Symantec Endpoint Protection 12.1 administrator has the Virus and Spyware Protection policy configured with Auto-Protect enabled. The administrator is confronted with computer performance issues. Which two options can the administrator use to improve performance? (Select two.)

Which object in the Symantec Endpoint Protection Manager console describes the most granular level to which a policy can be assigned?

The LiveUpdate Download Schedule is set to the default on the Symantec Endpoint Protection Manager (SEPM). How many content revisions must the SEPM keep to ensure clients that check in to the SEPM every 10 days receive xdelta content packages instead of full content packages?

An administrator notices that some entries list that the Risk was partially removed. The administrator needs to determine whether additional steps are necessary to remediate the threat. Where in the Symantec Endpoint Protection Manager console can the administrator find additional information on the risk?

The fake antivirus family "PC scout" infects systems with a similar method regardless of its variant.  Which SONAR sub-feature can block new variants of the same family, based on sequence of events?

When can an administrator add a new replication partner?

In which client management log can an administrator identify when the client last connected to the Symantec Endpoint Protection Manager?

A company has multiple offices and is unsure whether to use the Symantec Endpoint Protection Manager (SEPM) or the Group Update Provider (GUP) at the offices. When should the company use the SEPM rather than the GUP?

When can an administrator delete a location?

Immediately after installation, what does a managed client do to contact the Symantec Endpoint Protection Manager (SEPM)?

An administrator uses ClientSideClonePrepTool to clone systems and virtual machine deployment. What will the tool do when it is run on each system?

A Symantec Endpoint Protection administrator is using System Lockdown in blacklist mode with a file fingerprint list. When testing a client, the administrator notices that at least one of the files on the list is allowed to execute. What is the likely cause of the problem?

A Symantec Endpoint Protection 12.1 (SEP) administrator is remotely deploying SEP clients, but the clients are failing to install on Windows XP. Which two could be preventing installation? (Select two.)