最新的Symantec Administration of Symantec Advanced Threat Protection 3.0 - 250-441免費考試真題
問題1
Which two actions an Incident Responder take when downloading files from the ATP file store? (Choose two.)
正確答案: C,D
問題2
Which default port does ATP use to communicate with the Symantec Endpoint Protection Manager (SEPM) web services?
正確答案: D
問題3
Which detection method identifies a file as malware after SEP has queried the file's reputation?
正確答案: A
問題4
Why is it important for an Incident Responder to review Related Incidents and Events when analyzing an incident for an After Actions Report?
正確答案: D
問題5
Where can an Incident Responder view Cynic results in ATP?
正確答案: A
問題6
An Incident Responder has noticed that for the last month, the same endpoints have been involved with malicious traffic every few days. The network team also identified a large amount of bandwidth being used over P2P protocol.
Which two steps should the Incident Responder take to restrict the endpoints while maintaining normal use of the systems? (Choose two.)
Which two steps should the Incident Responder take to restrict the endpoints while maintaining normal use of the systems? (Choose two.)
正確答案: B,E
問題7
Which two questions can an Incident Responder answer when analyzing an incident in ATP? (Choose two.)
正確答案: B,D
問題8
Which two database attributes are needed to create a Microsoft SQL SEP database connection? (Choose two.)
正確答案: A,C
問題9
Malware is currently spreading through an organization's network. An Incident Responder sees some detections in SEP, but there is NOT an apparent relationship between them.
How should the responder look for the source of the infection using ATP?
How should the responder look for the source of the infection using ATP?
正確答案: D
問題10
Which stage of an Advanced Persistent Threat (APT) attack does social engineering occur?
正確答案: D
