Question 1

Which command line syntax invokes the Symantec Endpoint Protection Client Service to determine whether a more recent copy of the configuration file is available on the management server?

Accepted Answer

A)  smc -getconfig 
B)  smc -getsylink 
C)  smc -update 
D)  smc -updateconfig

Question 2

Multiple Windows virtual clients running on an ESX server need to be scanned daily by a scheduled scan. Which feature should an administrator use to improve scan performance on the clients?

Accepted Answer

A)  Virtual Image exceptions 
B)  Centralized Scan exceptions 
C)  Download Insight 
D)  Tamper Protection

Question 3

You have just started a relayout operation in a live test environment, and you want to limit the impact of your work on concurrent testing activities. You also want to accommodate the need to constrain a relayout job's performance impact on concurrent activities. What would you do to perform this task?

Accepted Answer

A)  Use the "set iodelay" option of vxtask to throttle the VxVM task. 
B)  Use the "set iowait" option of vxtask to throttle the VxVM task. 
C)  Use the "set slow" option of vxtask to throttle the VxVM task. 
D)  Use the "set nice" option of vxtask to throttle the VxVM task.

Question 4

A manufacturing company runs three shifts. Employees at the facility must share computers. The administrators need to apply different policies/configurations for each shift. The administrator will need to switch the clients to User mode. Which two additional configuration changes need to be made to allow policies to be applied to each shift? (Select two.)

Accepted Answer

A)  Create one group for all computers on each shift. 
B)  Create one group for all users on each shift. 
C)  Turn on inheritance for all groups. 
D)  Turn on inheritance for all users. 
E)  Turn off inheritance for each user group created.
F) Turn off inheritance for each computer group created.

Question 5

An administrator is using the SylinkDrop tool to update a Symantec Endpoint Protection client install on a system. The client fails to migrate to the new Symantec Endpoint Protection Manager (SEPM), which is defined correctly in the Sylink.xml file that was exported from the SEPM. Which settings must be provided with SylinkDrop to ensure the successful migration to a new Symantec Endpoint Protection environment with additional Group Level Security Settings?

Accepted Answer

A)  -s "silent" 
B)  -t "Tamper Protect" 
C)  -r "reboot" 
D)  -p "password"

Question 6

Refer to the exhibit.  An administrator has configured the Symantec Endpoint Protection Manager (SEPM) to use Active Directory authentication. The administrator defines a new Symantec Endpoint Protection administrator named Sep_SysAdmin, configured to use Directory Authentication. Which password needs to be entered when the administrator logs in to the SEPM console as Sep_SysAdmin?

Accepted Answer

A)  The password for the Active Directory account Nova_Grant 
B)  The password for the SEPM account Nova_Grant 
C)  The password for the Active Directory account Sep_SysAdmin 
D)  The password for the SEPM account Sep_SysAdmin

Question 7

An administrator plans to implement a multi-site Symantec Endpoint Protection (SEP) deployment.  The administrator needs to determine whether replication is viable without needing to make network firewall changes or change defaults in SEP. Which port should the administrator verify is open on the path of communication between the two proposed sites?

Accepted Answer

A)  1433 
B)  2967 
C)  8014 
D)  8443

Question 8

Which two sources can a Macintosh client use to download content? (Select two.)

Accepted Answer

A)  Symantec Endpoint Protection Manager 
B)  Group Update Provider (GUP) 
C)  Internal LiveUpdate server 
D)  Default Management server 
E)  Symantec LiveUpdate server

Question 9

For replication, Symantec recommends that the number of sites be kept to five for optimum performance. What can be done to reduce the number of sites?

Accepted Answer

A)  Replicate log data in both directions. 
B)  Limit the number of clients per manager. 
C)  Spread the clients over additional domains. 
D)  Add Group Update Providers for content distribution.

Question 10

Which step is unnecessary when an administrator creates an application rule set?

Accepted Answer

A)  define a provider 
B)  select a process to apply 
C)  select a process to exclude 
D)  define rule order

Question 11

Why does Power Eraser need Internet access?

Accepted Answer

A)  to leverage Symantec Insight 
B)  to validate root certificates on all portable executables (PX
E)  files 
C)  to ensure the Power Eraser tool is the latest release 
D)  to look up CVE vulnerabilities

Question 12

An administrator changes the Virus and Spyware Protection policy for a specific group that disables Auto-Protect. The administrator assigns the policy and the client systems applies the corresponding policy serial number. Upon visual inspection of a physical client system, the policy serial number is correct. However, Auto-Protect is still enabled on the client system. Which action should the administrator take to ensure that the desired setting is in place on the client?

Accepted Answer

A)  Restart the client system 
B)  Run a command on the computer to Update Content 
C)  Enable the padlock next to the setting in the policy 
D)  Withdraw the Virus and Spyware Protection policy

Question 13

Which two considerations must an administrator make when enabling Application Learning in an environment? (Select two.)

Accepted Answer

A)  Application Learning can generate increased false positives. 
B)  Application Learning should be deployed on a small group of systems in the enterprise. 
C)  Application Learning can generate significant CPU or memory use on a Symantec Endpoint Protection Manager. 
D)  Application Learning requires a file fingerprint list to be created in advance. 
E)  Application Learning is dependent on Insight.

Question 14

A company uses a remote administration tool that is detected and quarantined by Symantec Endpoint Protection (SEP). Which step can an administrator perform to continue using the remote administration tool without detection by SEP?

Accepted Answer

A)  create a Tamper Protect exception for the tool 
B)  create an Application to Monitor exception for the tool 
C)  create a Known Risk exception for the tool 
D)  create a SONAR exception for the tool

Question 15

A clean file in a proprietary application has been quarantined by SONAR. How can an administrator fix the broken application from the Symantec Endpoint Protection Manager console?

Accepted Answer

A)  Restore the application with the Client Deployment Wizard. 
B)  Allow the application from the Monitor Logs view. 
C)  Run the Enable Auto-Protect command on the client. 
D)  Run a new scan with a newer set of definitions.

Question 16

Refer to the exhibit.  A user runs a full scan on a system and is confused by the "Files trusted" count. Which option will result in the files being left unscanned?

Accepted Answer

A)  Enabling the "Only when files are executed" setting in the Virus and Spyware Protection policy. 
B)  Enabling the "Do not scan files when trusted processes access the files" setting in the Virus and Spyware Protection policy. 
C)  Enabling Insight in the Virus and Spyware Protection policy. 
D)  Enabling the file cache settings in the Virus and Spyware Protection policy.

Question 17

An administrator has defined a rule to allow traffic to and from a specific server by its Fully Qualified Domain Name (FQDN), because the server's IP address varies based on the office in which a client is located. The administrator attempts to verify the rule and finds that the traffic is being blocked. The logs list the IP address of the server instead of its FQDN. What does the administrator need to do within the firewall policy to allow the rule to work correctly?

Accepted Answer

A)  Enable DNS lookup. 
B)  Enable reverse DNS lookup. 
C)  Disable Smart DNS. 
D)  Disable NetBIOS Protection.

Question 18

Refer to the exhibit.  A company has created a specific firewall policy that allows only certain traffic. Which traffic is allowed in the firewall policy displayed in the exhibit?

Accepted Answer

A)  traffic on port 23 from Telnet (telnet.exe) 
B)  traffic on port 25 from Outlook (outlook.exe) 
C)  traffic on port 110 from Outlook (outlook.exe) 
D)  traffic on port 80 from Internet Explorer (iexplore.exe) 
E)  traffic on port 443 from Internet Explorer (iexplore.exe)

Question 19

A Symantec Endpoint Protection 12.1 (SEP) administrator discovers that a firewall is blocking Windows file sharing. Which method can bypass the firewall and allow the SEP clients to be installed with a minimum amount of effort?

Accepted Answer

A)  Remote Push 
B)  Web Link and Email 
C)  Create Pull Mode client 
D)  Administrative share (C$) deployment

Question 20

A company deploys Symantec Endpoint Protection (SEP) to 50 virtual machines running on a single ESXi host. Which configuration change can the administrator make to minimize sudden IOPS impact on the ESXi server while each SEP endpoint communicates with the Symantec Endpoint Protection Manager?

Accepted Answer

A)  increase Download Insight sensitivity level 
B)  reduce the heartbeat interval 
C)  increase download randomization window 
D)  reduce number of content revisions to keep

Exam 1: Administration of Symantec Endpoint Protection 14 (Broadcom)