Exam 5: Symantec Messaging Gateway 10.5 Technical Assessment (Broadcom)

A network control point discovered a botnet phone-home attempt in the network stream. Which detection method identified the event?

You place six physical disks under Volume Manager control to create 10GB of volume. You want to use this volume as an archive directory. You need to create a volume that will store three copies of the archived data. Which command will you use to create a volume with three plexes?

Refer to the exhibit. An administrator is testing the DLP installation by placing .EML files into the drop folder, but has been unsuccessful in generating any incidents. The administrator is checking the Advanced Server Settings page to see if it can help diagnose the issue. What could be causing this problem?

Which type of Mail Transfer Agent is required for automated group synchronization?

When attempting to log in as administrator to the UI, the administrator receives a login error: Invalid Username/Password or Disabled Account The DBA verifies the account is enabled. The information provided for the environment only includes the DLP protect database username and password as well as a username and password called Sys Admin\Admin. How should the administrator change the built-in 'Administrator' password?

Which endpoint detection method allows for information about triggered processes to be displayed in ATP?

You need to mirror an existing volume named mirvol1. You need to achieve the following goals: Mirror mirvol1: Should be a single mirror to the existing volume using disk mydg01: Synchronization must take place in the background: To meet the required goal, you execute the following command: vxassist -g mydg -b make mirror mirvol1 \ use_storage=' "DM"="mydg01" Which of the defined goals have been met?

What is the Symantec recommended best practice for testing a Data Protection policy?

Which two (2) events or methods allow the administrator to create a backup of Notification Server cryptographic keys? (Choose two.)

A medium-sized organization with 10,000 users at Site A and 20,000 users at Site B wants to use ATP: Network to scan internet traffic at both sites. Which physical appliances should the organization use to act as a network scanner at each site while using the fewest appliances and assuming typical network usage?

Which detection method identifies a file as malware after SEP has queried the file's reputation?

How does the ProxySG handle a rule that contains a syntax error when the ProxySG processes installed policy as part of a client transaction? (Choose the best answer.)

What is the standard Time to Live (TTL) for an MX Record?

What are two policy requirements for using the Isolate and Rejoin features in ATP? (Choose two.)

How does an attacker use a zero-day vulnerability during the Incursion phase?

You have designed a tiered storage environment using ISP volumes. You have also created the disk group that will be used to hold the tiered volumes. You now want to apply the appropriate tags to the disks. What should you do?

An ATP Administrator set up ATP: Network in TAP mode and has placed URLs on the blacklist. What will happen when a user attempts to access one of the blacklisted URLs?

While working under VxVM control, you discover that the vxplex command has failed because a previously attached plex did not complete. You get the following error messagE. "VxVM vxplex ERROR V-5-1-809 Plex plex1 in volume volume1 is locked by another utility." You must resolve this error with minimum administrative effort. How should you resolve this error?

What is the primary benefit of using Integrated Windows Authentication (IWA) authentication realms? (Choose the best answer.)

Why is it important for an Incident Responder to copy malicious files to the ATP file store or create an image of the infected system during the Recovery phase?