Question 1

Which protection engine should an administrator enable in order to drop malicious vulnerability scans against a client system?

Accepted Answer

A)  SONAR 
B)  Intrusion Prevention 
C)  Application and Device Control 
D)  Tamper Protection 
A)  SONAR 
B)  Intrusion Prevention 
C)  Application and Device Control 
D)  Tamper Protection B

Question 2

A large-scale virus attack is occurring and a notification condition is configured to send an email whenever viruses infect five computers on the network. A Symantec Endpoint Protection administrator has set a one hour damper period for that notification condition. How many notifications dos the administrator receive after 30 computers are infected in two hours?

Accepted Answer

A)  1 
B)  15 
C)  6 
D)  2 
A)  1 
B)  15 
C)  6 
D)  2 D

Question 3

An organization has several Symantec Endpoint Protection Management (SEPM) Servers without access to the Internet. The SEPM can only run LiveUpdate within a specified "maintenance window" outside of business hours. What content distribution method should the organization utilize?

Accepted Answer

A)  Group Update Provider 
B)  External LiveUpdate 
C)  JDB file 
D)  Internal LiveUpdate 
A)  Group Update Provider 
B)  External LiveUpdate 
C)  JDB file 
D)  Internal LiveUpdate A

Question 4

An administrator receives a browser certificate warning when accessing the Symantec Endpoint Protection Manager (SEPM) Web console. Where can the administrator obtain the certificate?

Accepted Answer

A)  SEPM Web Access 
B)  SEPM SecureID Authentication 
C)  SEPM console Admin Tasks 
D)  SEPM console Licenses section 
A)  SEPM Web Access 
B)  SEPM SecureID Authentication 
C)  SEPM console Admin Tasks 
D)  SEPM console Licenses section

Question 5

Which tool should the administrator run before starting the Symantec Endpoint Protection Manager upgrade according to best practices?

Accepted Answer

A)  CollectLog.cmd 
B)  DBValidator.bat 
C)  LogExport.cmd 
D)  Upgrade.exe 
A)  CollectLog.cmd 
B)  DBValidator.bat 
C)  LogExport.cmd 
D)  Upgrade.exe

Question 6

A company needs to configure an Application and Device Control policy to block read/write access to all USB removable media on its Symantec Endpoint Protection (SEP) systems. Which tool should an administrator use to format the GUID and device IDs as required by SEP?

Accepted Answer

A)  CheckSum.exe 
B)  DevViewer.exe 
C)  TaskMgr.exe 
D)  DeviceTree.exe 
A)  CheckSum.exe 
B)  DevViewer.exe 
C)  TaskMgr.exe 
D)  DeviceTree.exe

Question 7

Which two instances could cause Symantec Endpoint Protection to be unable to remediate a file? (Select two.)

Accepted Answer

A)  Another scan is in progress. 
B)  The detected file is in use. 
C)  The file has good reputation. 
D)  There are insufficient file permissions. 
E)  The file is marked for deletion by Windows on restart. 
A)  Another scan is in progress. 
B)  The detected file is in use. 
C)  The file has good reputation. 
D)  There are insufficient file permissions. 
E)  The file is marked for deletion by Windows on restart.

Question 8

How could an administrator decrease the timeout period before logging back onto the management console?

Accepted Answer

A)  On the General tab of the Server Properties , click the Console Timeout drop-down list and select one of the available options for length of time On the General tab of the Server Properties , click the Console Timeout drop-down list and select one of the available options for length of time 
B)  On the General tab of the Domain Properties , click the Console Timeout drop-down list and select one of the available options for length of time Domain Properties , click the Console Timeout 
C)  On the General tab of the Site Properties , click the Console Timeout drop-down list and select one of the available options for length of time Site Properties 
D)  On the General tab of the Administrator Properties , click the Console Timeout drop-down list and select one of the available options for length of time Administrator Properties 
A)  On the General tab of the Server Properties , click the Console Timeout drop-down list and select one of the available options for length of time On the General tab of the Server Properties , click the Console Timeout drop-down list and select one of the available options for length of time 
B)  On the General tab of the Domain Properties , click the Console Timeout drop-down list and select one of the available options for length of time Domain Properties , click the Console Timeout 
C)  On the General tab of the Site Properties , click the Console Timeout drop-down list and select one of the available options for length of time Site Properties 
D)  On the General tab of the Administrator Properties , click the Console Timeout drop-down list and select one of the available options for length of time Administrator Properties

Question 9

A company uses a remote administration tool that is detected as Hacktool.KeyLoggPro and quarantined by Symantec Endpoint Protection (SEP). Which step can an administrator perform to continue using the remote administration tool without detection by SEP?

Accepted Answer

A)  Create a Tamper Protect exception for the tool 
B)  Create a SONAR exception for the tool 
C)  Create an Application to Monitor exception for the tool 
D)  Create a Known Risk exception for the tool 
A)  Create a Tamper Protect exception for the tool 
B)  Create a SONAR exception for the tool 
C)  Create an Application to Monitor exception for the tool 
D)  Create a Known Risk exception for the tool

Question 10

In addition to performance improvements, which two benefits does Insight provide? (Select two)

Accepted Answer

A)  Reputation scoring for documents. 
B)  False positive migration. 
C)  Zero-day threat detection. 
D)  Blocks malicious websites. 
E)  Protects against malicious java scripts. 
A)  Reputation scoring for documents. 
B)  False positive migration. 
C)  Zero-day threat detection. 
D)  Blocks malicious websites. 
E)  Protects against malicious java scripts.

Question 11

A company deploys Symantec Endpoint Protection client to its sales staff who travel across the country. Which deployment method should the company use to notify its sales staff to install the client?

Accepted Answer

A)  Unmanaged Detector 
B)  Client Deployment Wizard 
C)  Pull mode 
D)  Push mode 
A)  Unmanaged Detector 
B)  Client Deployment Wizard 
C)  Pull mode 
D)  Push mode

Question 12

Which package type should an administrator use to reduce a SEP environment's footprint when considering that new SEP 14 clients will be installed on point of sale terminals?

Accepted Answer

A)  Default Standard Client 
B)  Default Embedded or VDI client 
C)  Default dark network client 
D)  Custom Standard client 
A)  Default Standard Client 
B)  Default Embedded or VDI client 
C)  Default dark network client 
D)  Custom Standard client

Question 13

A company has 10,000 Symantec Endpoint Protection (SEP) clients deployed using two Symantec Endpoint Protection Managers (SEPMs). Which configuration is recommended to ensure that each SEPM is able to effectively handle the communications load with the SEP clients?

Accepted Answer

A)  Pull mode 
B)  Push mode 
C)  Server control mode 
D)  Client control mode 
A)  Pull mode 
B)  Push mode 
C)  Server control mode 
D)  Client control mode

Question 14

Which feature reduces the impact of Auto-Protect on a virtual client guest operating system?

Accepted Answer

A)  Network Shared Insight Cache 
B)  Scan Randomization 
C)  Virtual Shared Insight Cache 
D)  Virtual Image Exception 
A)  Network Shared Insight Cache 
B)  Scan Randomization 
C)  Virtual Shared Insight Cache 
D)  Virtual Image Exception

Question 15

An organization's Limited Administrator needs to create an exclusion. When the Limited Administrator logs in, they do NOT see Exceptions listed as an option on the Policies page. What setting should a System Administrator enable so the Limited Administrator could see Exceptions and create an exclusion?

Accepted Answer

A)  Edit the Limited Administrator properties and uncheck Do not allow editing of shared policies in the Access Rights tab Edit the Limited Administrator properties and uncheck Do not allow editing of shared policies in the Access Rights tab 
B)  Edit the Limited Administrator properties and link the Administrator to an Active Directory account with Administrator privileges in the Authentication tab and link the Administrator to an Active Directory account with Administrator privileges in the Authentication tab 
C)  Edit the Limited Administrator properties and ensure Exceptions is checked under Policy rights in Access Rights tab and ensure Exceptions is checked under Policy rights in 
D)  Edit the Limited Administrator properties and change to Administrator in the Access Rights tab and change to Administrator 
A)  Edit the Limited Administrator properties and uncheck Do not allow editing of shared policies in the Access Rights tab Edit the Limited Administrator properties and uncheck Do not allow editing of shared policies in the Access Rights tab 
B)  Edit the Limited Administrator properties and link the Administrator to an Active Directory account with Administrator privileges in the Authentication tab and link the Administrator to an Active Directory account with Administrator privileges in the Authentication tab 
C)  Edit the Limited Administrator properties and ensure Exceptions is checked under Policy rights in Access Rights tab and ensure Exceptions is checked under Policy rights in 
D)  Edit the Limited Administrator properties and change to Administrator in the Access Rights tab and change to Administrator

Question 16

What SEPM report should an administrator utilize to view the files that Download Insight detected on your computers, after configuring Download Insight?

Accepted Answer

A)  Risk Distribution 
B)  SONAR Detection Results 
C)  Download Risk Distribution 
D)  Risk Detections Count 
A)  Risk Distribution 
B)  SONAR Detection Results 
C)  Download Risk Distribution 
D)  Risk Detections Count

Question 17

Which action should an administrator take to prevent users from using Windows Security Center?

Accepted Answer

A)  Set Disable antivirus alert within Windows Security Center to Disable 
B)  Set Disable Windows Security Center to Always 
C)  Set Disable Windows Security Center to Disable 
D)  Set Disable antivirus alert within Windows Security Center to Never 
A)  Set Disable antivirus alert within Windows Security Center to Disable 
B)  Set Disable Windows Security Center to Always 
C)  Set Disable Windows Security Center to Disable 
D)  Set Disable antivirus alert within Windows Security Center to Never

Question 18

Which technology can prevent an unknown executable from being downloaded through a browser session?

Accepted Answer

A)  Insight 
B)  Advanced Machine Learning 
C)  Application Control 
D)  Intrusion Prevention 
A)  Insight 
B)  Advanced Machine Learning 
C)  Application Control 
D)  Intrusion Prevention

Question 19

An organization has a group of 500 SEP for Windows Clients running 12.1 RU5. The organization wants to migrate the clients to 14 RU1, but must minimize WAN bandwidth usage. What installation method should the organization use?

Accepted Answer

A)  Push Deployment Wizard 
B)  Clients Install Package hosted on a local HTTP Server 
C)  Client Deployment Wizard 
D)  Auto Upgrade 
A)  Push Deployment Wizard 
B)  Clients Install Package hosted on a local HTTP Server 
C)  Client Deployment Wizard 
D)  Auto Upgrade

Question 20

An organization needs to be notified when certain types of events happen in their SEP environment. What notification type should the SEP Administrator create to see attacks and events that the firewall or Intrusion Protection System (IPS) detects?

Accepted Answer

A)  Create a Client Security Notification that filters by Traffic Events Create a Client Security Notification that filters by Traffic Events 
B)  Create a Client Security Notification that filters by Compliance Events Compliance Events 
C)  Create a Client Security Notification that filters by Network and Host Mitigation Events Network and Host Mitigation Events 
D)  Create a Client Security Notification that filters by Packet Events Packet Events 
A)  Create a Client Security Notification that filters by Traffic Events Create a Client Security Notification that filters by Traffic Events 
B)  Create a Client Security Notification that filters by Compliance Events Compliance Events 
C)  Create a Client Security Notification that filters by Network and Host Mitigation Events Network and Host Mitigation Events 
D)  Create a Client Security Notification that filters by Packet Events Packet Events

Which protection engine should an administrator enable in order to drop malicious vulnerability scans against a client system?

An organization has several Symantec Endpoint Protection Management (SEPM) Servers without access to the Internet. The SEPM can only run LiveUpdate within a specified "maintenance window" outside of business hours. What content distribution method should the organization utilize?

An administrator receives a browser certificate warning when accessing the Symantec Endpoint Protection Manager (SEPM) Web console. Where can the administrator obtain the certificate?

Which tool should the administrator run before starting the Symantec Endpoint Protection Manager upgrade according to best practices?

A company needs to configure an Application and Device Control policy to block read/write access to all USB removable media on its Symantec Endpoint Protection (SEP) systems. Which tool should an administrator use to format the GUID and device IDs as required by SEP?

Which two instances could cause Symantec Endpoint Protection to be unable to remediate a file? (Select two.)

How could an administrator decrease the timeout period before logging back onto the management console?

A company uses a remote administration tool that is detected as Hacktool.KeyLoggPro and quarantined by Symantec Endpoint Protection (SEP). Which step can an administrator perform to continue using the remote administration tool without detection by SEP?

In addition to performance improvements, which two benefits does Insight provide? (Select two)

A company deploys Symantec Endpoint Protection client to its sales staff who travel across the country. Which deployment method should the company use to notify its sales staff to install the client?

Which package type should an administrator use to reduce a SEP environment's footprint when considering that new SEP 14 clients will be installed on point of sale terminals?

A company has 10,000 Symantec Endpoint Protection (SEP) clients deployed using two Symantec Endpoint Protection Managers (SEPMs). Which configuration is recommended to ensure that each SEPM is able to effectively handle the communications load with the SEP clients?

Which feature reduces the impact of Auto-Protect on a virtual client guest operating system?

What SEPM report should an administrator utilize to view the files that Download Insight detected on your computers, after configuring Download Insight?

Which action should an administrator take to prevent users from using Windows Security Center?

Which technology can prevent an unknown executable from being downloaded through a browser session?

An organization has a group of 500 SEP for Windows Clients running 12.1 RU5. The organization wants to migrate the clients to 14 RU1, but must minimize WAN bandwidth usage. What installation method should the organization use?

An organization needs to be notified when certain types of events happen in their SEP environment. What notification type should the SEP Administrator create to see attacks and events that the firewall or Intrusion Protection System (IPS) detects?

Administration of Symantec Endpoint Protection 14 (Broadcom)

Administration of Symantec Data Loss Prevention 12 (Broadcom)

Administration of Symantec ProxySG 6.7

Symantec Messaging Gateway 10.5 Technical Assessment (Broadcom)

Filters

Exam 2: Administration of Symantec Email Security.cloud (v1)

Which protection engine should an administrator enable in order to drop malicious vulnerability scans against a client system?

An organization has several Symantec Endpoint Protection Management (SEPM) Servers without access to the Internet. The SEPM can only run LiveUpdate within a specified "maintenance window" outside of business hours. What content distribution method should the organization utilize?

An administrator receives a browser certificate warning when accessing the Symantec Endpoint Protection Manager (SEPM) Web console. Where can the administrator obtain the certificate?

Which tool should the administrator run before starting the Symantec Endpoint Protection Manager upgrade according to best practices?

A company needs to configure an Application and Device Control policy to block read/write access to all USB removable media on its Symantec Endpoint Protection (SEP) systems. Which tool should an administrator use to format the GUID and device IDs as required by SEP?

Which two instances could cause Symantec Endpoint Protection to be unable to remediate a file? (Select two.)

How could an administrator decrease the timeout period before logging back onto the management console?

A company uses a remote administration tool that is detected as Hacktool.KeyLoggPro and quarantined by Symantec Endpoint Protection (SEP). Which step can an administrator perform to continue using the remote administration tool without detection by SEP?

In addition to performance improvements, which two benefits does Insight provide? (Select two)

A company deploys Symantec Endpoint Protection client to its sales staff who travel across the country. Which deployment method should the company use to notify its sales staff to install the client?

Which package type should an administrator use to reduce a SEP environment's footprint when considering that new SEP 14 clients will be installed on point of sale terminals?

A company has 10,000 Symantec Endpoint Protection (SEP) clients deployed using two Symantec Endpoint Protection Managers (SEPMs). Which configuration is recommended to ensure that each SEPM is able to effectively handle the communications load with the SEP clients?

Which feature reduces the impact of Auto-Protect on a virtual client guest operating system?

What SEPM report should an administrator utilize to view the files that Download Insight detected on your computers, after configuring Download Insight?

Which action should an administrator take to prevent users from using Windows Security Center?

Which technology can prevent an unknown executable from being downloaded through a browser session?

An organization has a group of 500 SEP for Windows Clients running 12.1 RU5. The organization wants to migrate the clients to 14 RU1, but must minimize WAN bandwidth usage. What installation method should the organization use?

An organization needs to be notified when certain types of events happen in their SEP environment. What notification type should the SEP Administrator create to see attacks and events that the firewall or Intrusion Protection System (IPS) detects?

Administration of Symantec Endpoint Protection 14 (Broadcom)

Administration of Symantec Data Loss Prevention 12 (Broadcom)

Administration of Symantec ProxySG 6.7

Symantec Messaging Gateway 10.5 Technical Assessment (Broadcom)

Filters