Exam 1: Administration of Symantec Endpoint Protection 14 (Broadcom)

A company deploys Symantec Endpoint Protection client to its sales staff who travel across the country. Which deployment method should the company use to notify its sales staff to install the client?

In Symantec Endpoint Protection 12.1 Enterprise Edition (SEP), what happens when the Soft Enforcement license expires?

A Symantec Endpoint Protection administrator needs to prevent users from modifying files in a specific program folder that is on all client machines. What does the administrator need to configure?

A Symantec Endpoint Protection (SEP) client uses a management server list with three management servers in the priority 1 list. Which mechanism does the SEP client use to select an alternate management server if the currently selected management server is unavailable?

What is the likely impact of increasing the Download Insight sensitivity?

What does SONAR use to reduce false positives?

A Symantec Endpoint Protection 12.1 group has two defined locations based on whether clients are attached to the local network or are remote. The local network location has an administrator- defined scan scheduled to begin each Monday at 09:00. The remote location has an administrator- defined scan scheduled to begin each Wednesday night at 21:00. All systems are used daily and remain powered on all night. Some users in the group have laptops, while the other users have standard desktops. Assuming the laptops are taken home and used each night, what is the effect?

Which technology uses heuristics to scan outbound email?

What is an appropriate use of a file fingerprint list?

What could be an adverse effect of activating aggressive mode on the SONAR policy?

A company recently purchased the Symantec Endpoint Protection 12.1 (SEP) product. It has two datacenters and wants to configure SEP for high availability, so that if one datacenter goes down, the SEP clients can smoothly fail over to the other datacenter. What should be done to allow SEP clients to fail over from one datacenter to the next?

Which two options are available when configuring high risk detection in SONAR? (Select two.)

Which policy should an administrator modify to enable Virtual Image Exception (VIE) functionality?

Which action should an administrator take to prevent users from using Windows Security Center?

Which Symantec Endpoint Protection defense mechanism provides protection against threats that propagate from system to system through the use of autorun.inf files?

Acrobat Reader is being targeted by a threat using process injection. Which feature of SONAR is sandboxing Acroread32.exe so that the threat is prevented from dropping its payload?

Which protection technology assists in protecting documents in real-time when accessed or modified?

A company allows users to create firewall rules. During the course of business, users are accidentally adding rules that block a custom internal application. Which steps should the Symantec Endpoint Protection administrator take to prevent users from blocking the custom application?

A Symantec Endpoint Protection administrator must block traffic from an attacking computer for a specific time period. Where should the administrator adjust the time to block the attacking computer?

What are two criteria that Symantec Insight uses to evaluate binary executables? (Select two.)