Question 1

Which object in the Symantec Endpoint Protection Manager console describes the most granular level to which a policy can be assigned?

Accepted Answer

A)  Group 
B)  User 
C)  Client 
D)  Computer

Question 2

An administrator notices that some entries list that the Risk was partially removed. The administrator needs to determine whether additional steps are necessary to remediate the threat. Where in the Symantec Endpoint Protection Manager console can the administrator find additional information on the risk?

Accepted Answer

A)  Infected and At Risk Computers report 
B)  Risk log 
C)  Notifications 
D)  Computer Status report

Question 3

What happens when the license expires in Symantec Endpoint Protection 14 Enterprise Edition?

Accepted Answer

A)  Group Update Providers (GUP) stop 
B)  Symantec Insight is disabled 
C)  Content updates continue 
D)  LiveUpdate stops

Question 4

Where could a SEP Administrator specify a notice to display before logging onto the Symantec Endpoint Protection Manager?

Accepted Answer

A)  Add banner title and banner text under the Logon Banner 
B)  Once a month 
C)  Everyday 
D)  Every two weeks

Question 5

In which two areas can host groups be used? (Select two.)

Accepted Answer

A)  Locations 
B)  Download Insight 
C)  IPS 
D)  Application and Device Control 
E)  Firewall

Question 6

Which action can an administrator take to improve the Symantec Endpoint Protection Manager (SEPM) dashboard performance and report accuracy?

Accepted Answer

A)  Rebuilding database indexes 
B)  Lowering the client installation log entries 
C)  Limiting the number of backups to keep 
D)  Decreasing the number of content revisions to keep

Question 7

A company deploys Symantec Endpoint Protection (SEP) to50 virtual machines running on a single ESXi host. Which configuration change can the administrator make to minimize sudden IOPS impact on the ESXi server while each SEP endpoint communicates with the Symantec Endpoint Protection Manager?

Accepted Answer

A)  Reduce number of content revisions to keep 
B)  Increase download randomization window 
C)  Reduce the heartbeat interval 
D)  Increase Download Insight sensitivity level

Question 8

An organization needs to ensure that SEP detects a malicious or potentially malicious file when downloaded via a text messaging client. What feature can an organization enable in the Virus and Spyware Protection policy and modify its sensitivity settings?

Accepted Answer

A)  Global Scan Options 
B)  SONAR 
C)  Internet Email Auto Protect 
D)  Download Protection

Question 9

Where does an administrator review logs, after enabling debug logging for client communication on a SEP for Mac client?

Accepted Answer

A)  /Library/Application Support/Symantec/SMC/log/syslog.log 
B)  /Library/Application Support/Symantec/SMC/debug/als_debug.log 
C)  /Library/Application Support/Symantec/SMC/debug/smc_debug.log 
D)  /Library/Application Support/Symantec/SMC/log/sylink.log

Question 10

Which two considerations must an administrator make when enabling Application Learning in an environment? (Select two.)

Accepted Answer

A)  Application Learning should be deployed on a small group of systems in the enterprise. 
B)  Application Learning can generate significant CPU or memory use on a Symantec Endpoint Protection Manager. 
C)  Application Learning is dependent on Insight. 
D)  Application Learning requires a file fingerprint list to be created in advance. 
E)  Application Learning can generate increased false positives.

Question 11

Which settings can impact the Files trusted count?

Accepted Answer

A)  System Lockdown Whitelist in the Application and Device Control Policy 
B)  File Cache settings in the Virus and Spyware Protection policy 
C)  Insight settings in the Virus and Spyware Protection policy 
D)  SONAR settings in the Virus and Spyware Protection policy

Question 12

What are two methods the SEP Administrator can use for gathering a fingerprint list? (Choose two.)

Accepted Answer

A)  GatherSymantecInfo 
B)  DevViewer 
C)  Checksum 
D)  DeviceInf 
E)  Get File Fingerprint list command

Question 13

What is the difference between a Block versus a Terminate action, when creating an Application Control rule?

Accepted Answer

A)  A Block action prevents a child process from running. A Terminate action kills the application making the request or the caller process. 
B)  A Block action excludes the child process from being scanned. A Terminate action prevents the process from running. 
C)  A Block action places the process in Quarantine. A Terminate action kills the application making the request or the caller process. 
D)  A Block action prevents the process to be left alone. A Terminate action prevents the process from running.

Question 14

A financial company enforces a security policy that prevents banking system workstations from connecting to the Internet. Which Symantec Endpoint Protection technology is ineffective on this company's workstations?

Accepted Answer

A)  Insight 
B)  Network Threat Protection 
C)  Browser Intrusion Prevention 
D)  Intrusion Prevention

Question 15

What two core technologies does Symantec Endpoint Protection firewall utilize? (Choose two.)

Accepted Answer

A)  Circuit-level gateway 
B)  Packet filtering 
C)  Stateful 
D)  Application-level gateway 
E)  Deep packet inspection

Question 16

A company receives a high number of reports from users that files being downloaded from internal web servers are blocked. The Symantec Endpoint Protection administrator verifies that the Automatically trust any file downloaded from an intranet website option is enabled. Which configuration can cause Insight to block the files being downloaded from the internal web servers?

Accepted Answer

A)  Virus and Spyware definitions are out of date. 
B)  Local intranet zone is configured incorrectly on the Mac clients browser settings. 
C)  Intrusion prevention is disabled. 
D)  Local intranet zone is configured incorrectly on the Windows clients browser settings.

Question 17

An organization would like to control the policies that the client uses when connecting over VPN, but wants to use a different set of policies in the office. How should an administrator implement this?

Accepted Answer

A)  Create a Location called VPN and a Group called Office. Allow the client to switch to the VPN location when the user is working remote. 
B)  Create a Group called VPN and a Location called Office. Allow the client to switch to the VPN location when the user is working remote. 
C)  Create a Location called VPN and a Location called Office. Allow the client to switch to the VPN location when the user is working remote. 
D)  Create a Group called VPN and a Group called Office. Move the client to the VPN group when the user is working remotely.

Question 18

Which option is unavailable in the Symantec Endpoint Protection console to run a command on the group menu item?

Accepted Answer

A)  Disable SONAR 
B)  Scan 
C)  Disable Network Threat Protection 
D)  Update content and scan

Question 19

Which client log shows that a client is downloading content from its designated source?

Accepted Answer

A)  Log.LiveUpdate 
B)  System Log 
C)  Risk Log 
D)  SesmLu.log

Question 20

Catastrophic hardware failure has occurred on a single Symantec Endpoint Protection Manager (SEPM) in an environment with two SEPMs. What is the quickest way an administrator can restore the environment to its original state?

Accepted Answer

A)  Install a new SEPM into the existing site 
B)  Reinstall the entire SEPM environment 
C)  Clone the still functioning SEPM and change the server.properties file 
D)  Build a new site and configure replication with the still functioning SEPM

Exam 2: Administration of Symantec Email Security.cloud (v1)