Question 1

What steps should an administrator take to utilize Symantec Endpoint Protection in a non-persistent virtual desktop infrastructure?

Accepted Answer

A)  Setup the base image and configure client logs in the SEPM console 
B)  Setup the base image and configure a separate purge interval for offline non-persistent VDI clients in the SEPM console 
C)  Setup the base image and delete offline clients in the SEPM console 
D)  Setup the base image and configure "Delete clients that have not connected for a specified time" setting from the default of 30 to 1 in the SEPM console

Question 2

A Symantec Endpoint Protection (SEP) administrator creates a firewall policy to block FTP traffic and assigns the policy to all of the SEP clients. The network monitoring team informs the administrator that a client system is making an FTP connection to a server. While investigating the problem from the SEP client GUI, the administrator notices that there are zero entries pertaining to FTP traffic in the SET Traffic log or Packet log. While viewing the Network Activity dialog, there is zero inbound/outbound traffic for the FTP process. What is the most likely reason?

Accepted Answer

A)  The server is in the IPS policy excluded hosts list. 
B)  The block rule is below the blue line. 
C)  Peer-to-peer authentication is allowing the traffic. 
D)  The server has an IPS exception for that traffic.

Question 3

Which task should an administrator perform to troubleshoot operation of the Symantec Endpoint Protection embedded database?

Accepted Answer

A)  Verify the sqlserver.exe service is running on port 1433 
B)  Verify that dbsrv11.exe is listening on port 2638 
C)  Check the database transaction logs in X:\Program Files\Microsoft SQL Server 
D)  Check whether the MSSQLSERVER service is running

Question 4

A Symantec Endpoint Protection (SEP) administrator performed a disaster recovery without a database backup. In which file should the SEP administrator add "scm.agent.groupcreation=true" to enable the automatic creation of client groups?

Accepted Answer

A)  conf.properties 
B)  httpd.conf 
C)  settings.conf 
D)  catalina.out

Question 5

Why is Notepad unable to save the changes to the file in the image below?

Accepted Answer

A)  SONAR High Risk detection is set to Block 
B)  SONAR is set to block host file modifications. 
C)  Tamper Protection is preventing Notepad from modifying the host file. 
D)  System Lockdown is enabled.

Question 6

An organization needs to add a collection of DNS host names to permit in the firewall policy. How should the SEP Administrator add these DNS host names as a single rule in the firewall policy?

Accepted Answer

A)  Create a Host Group and add the DNS domain . Then create a firewall rule with the new Host Group as the Source/Destination Create a Host Group and add the DNS domain . Then create a firewall rule with the new as the Source/Destination 
B)  Create a Host Group and add the DNS host names . Then create a firewall rule with the new Host Group as the Source/Destination DNS host names . Then create a firewall rule with the new 
C)  Create a Host Group and add the DNS host names . Then create a firewall rule with the new Host Group as the Local/Remote Local/Remote 
D)  Create a Host Group and add the DNS domain . Then create a firewall rule with the new Host Group as the Local/Remote Create a Host Group

Question 7

Which policy should an administrator modify to enable Virtual Image Exception (VIE) functionality?

Accepted Answer

A)  Host Integrity Policy 
B)  Exceptions Policy 
C)  Virus and Spyware Protection Policy 
D)  Application and Device Control Policy

Question 8

An administrator is troubleshooting a Symantec Endpoint Protection (SEP) replication. Which component log should the administrator check to determine whether the communication between the two sites is working correctly?

Accepted Answer

A)  Tomcat 
B)  Apache Web Server 
C)  Group Update Provider (GUP) 
D)  SQL Server

Question 9

An administrator selects the Backup files before attempting to repair the Remediations option in the Auto-Protect policies. Which two actions occur when a virus is detected? (Select two.)

Accepted Answer

A)  Send the file to Symantec Insight 
B)  Check the reputation 
C)  Encrypt the file 
D)  Replace the file with a place holder 
E)  Store in Quarantine folder

Question 10

A Symantec Endpoint Protection administrator must block traffic from an attacking computer for a specific time period. Where should the administrator adjust the time to block the attacking computer?

Accepted Answer

A)  In the group policy, under External Communication settings 
B)  In the group policy, under Communication settings 
C)  In the firewall policy, under Protection and Stealth 
D)  In the firewall policy, under Built in Rules

Question 11

What type of exceptions can an administrator create from the Symantec Endpoint Protection Manager for a Mac client?

Accepted Answer

A)  Security Risk Exceptions - File 
B)  Security Risk Exceptions for both File or Folder 
C)  Security Risk Exceptions - Folder 
D)  Security Risk Exceptions - Extension

Question 12

An organization has four locations setup in their Symantec Endpoint Protection Environment to match the physical sites they have - NAM, LATAM, EMEA, and APAC. When users travel from site to site, they would like to control which SEPM a client connects to based on the client's proximity to the nearest SEPM server. The location is triggered by IP range assigned by the DHCP of that site. How can the organization utilize Locations to control which SEPM or set of SEPMs the clients connect to?

Accepted Answer

A)  Assign the Management Server list to the Group with the appropriate SEPM order. (Each SEPM is on the same priority level) 
B)  Assign the Management Server list to the Location and Group with the appropriate SEPM order. (Each SEPM has its own priority level) 
C)  Assign the Management Server list to the Location with the appropriate SEPM order. (Each SEPM has its own priority level) 
D)  Assign the Management Server list to the Location under My Company. (Each SEPM is on the same priority level)

Question 13

An administrator is recovering from a Symantec Endpoint Manager (SEPM) site failure. Which file should the administrator use during an install of SEPM to recover the lost environment according to Symantec Disaster Recovery Best Practice documentation?

Accepted Answer

A)  Original installation log 
B)  Sylink.xml file from the SEPM 
C)  Settings.properties file 
D)  Recovery_timestamp file

Question 14

Which Symantec Endpoint Protection defense mechanism provides protection against threats that propagate from system to system through the use of autorun.inf files?

Accepted Answer

A)  Host Integrity 
B)  SONAR 
C)  Application and Device Control 
D)  Emulator

Question 15

How should an administrator set up an alert to be notified when manual remediation is needed on an endpoint?

Accepted Answer

A)  Add a System event notification and specify "Left Alone" for the action taken. Choose to log the notification and send an e-mail to the system administrators 
B)  Add a Single Risk Event notification and specify "Left Alone" for the action taken. Choose to log the notification and send an e-mail to the system administrators 
C)  Add a New risk detected notification and specify "Left Alone" for the action taken. Choose to log the notification and send an e-mail to the system administrators 
D)  Add a Client security alert notification and specify "Left Alone" for the action taken. Choose to log the notification and send an e-mail to the system administrators

Question 16

Which two settings does an administrator enable to use the Risk Tracer Feature in the Virus and Spyware Protection policy? (Select two.)

Accepted Answer

A)  Firewall Policy 
B)  Application and Device Control Policy 
C)  Application Learning 
D)  Tamper Protection 
E)  IPS active response

Question 17

Which protection technology can detect botnet command and control traffic generated on the Symantec Endpoint Protection client machine?

Accepted Answer

A)  Intrusion Prevention 
B)  Insight 
C)  Risk Tracer 
D)  SONAR

Question 18

What SEP feature is leveraged when configuring custom IPS?

Accepted Answer

A)  Firewall 
B)  Virus and Spyware 
C)  Host Integrity 
D)  SONAR

Question 19

Which two criteria should an administrator use when defining Location Awareness for the Symantec Endpoint Protection (SEP) client? (Select two.)

Accepted Answer

A)  SEP domain 
B)  WINS server 
C)  Network Speed 
D)  NIC description 
E)  geographic location

Question 20

A company plans to install six Symantec Endpoint Protection Managers (SEPMs) spread evenly across two sites. The administrator needs to direct replication activity to SEPM3 server in Site 1 and SEPM4 in Site 2. Which two actions should the administrator take to direct replication activity to SEPM3 and SEPM4? (Select two.)

Accepted Answer

A)  Install the SQL Server databases on SEPM3 and SEPM4 
B)  Ensure SEPM3 and SEPM4 are in the same time zone 
C)  Ensure SEPM3 and SEPM4 are defined as remote servers in the replication partner configuration 
D)  Install SEPM3 and SEPM4 after the other SEPMs 
E)  Ensure SEPM3 and SEPM4 are defined as the top priority server in in the Site Settings

Exam 2: Administration of Symantec Email Security.cloud (v1)