最新的Symantec Endpoint Security認證 250-604考試題庫

問題1

What is the role of the Drift Monitoring feature in SES Complete App Control?

A. Identifying changes in application behavior against baseline policies

B. Recording video footage of end-user activity

C. Enforcing file integrity rules

D. Blocking unverified USB devices

正確答案: A

問題2

What challenge may arise if endpoint devices in a hybrid environment are not correctly grouped when transitioning policy control from SEPM to ICDm?

A. Policies will be updated only once per month.

B. Endpoints may receive duplicate alerts for malware.

C. Policy drift may occur, resulting in non-compliant configurations.

D. Devices will lose connectivity with the Symantec Global Intelligence Network.

正確答案: C

問題3

Your organization recently experienced a targeted attack where the threat actor used credential dumping and modified registry keys to remain persistent.
What SES Complete features should you review or configure to mitigate similar threats in the future? (Choose three)

A. Credential Access Monitoring

B. Log Forwarding Configuration

C. Registry Write Protection

D. Policy Versioning

E. Application Control Policy

正確答案: A,C,E

問題4

Which threat category is associated with defense evasion techniques in the MITRE ATT&CK framework?

A. Privilege Escalation

B. Credential Access

C. Obfuscation

D. Execution

正確答案: C

問題5

During a weekly review, you identify multiple unresolved incidents in ICDm. You are tasked with improving visibility and response accuracy.
What steps should you take using ICDm capabilities? (Choose three)

A. Disable endpoint policies temporarily

B. Generate a custom report on unresolved incidents

C. Analyze threat activity timelines for correlations

D. Customize the Security Control Dashboard filters

E. Reset all endpoint agents

正確答案: B,C,D

問題6

What kind of threat activities can be effectively identified through the use of Threat Defense for Active Directory?

A. Bluetooth sniffing attacks across user devices

B. Code obfuscation in signed .NET libraries

C. Kerberoasting, brute force login attempts, and privilege escalation techniques

D. In-memory exploitation of Java processes

正確答案: C

問題7

What is a key benefit of using SES Complete's mobile threat detection capabilities?

A. They support real-time vulnerability patching

B. They replace the need for traditional endpoint AV on desktops

C. They provide threat visibility and automatic mitigation on mobile platforms

D. They prevent mobile devices from installing any third-party apps

正確答案: C

問題8

Which EDR settings are essential for configuring incident response workflows in ICDm? (Choose two)

A. Weekly compliance email summary

B. Color coding for UI preferences

C. Auto-quarantine for high-risk behavior

D. Integration with Threat Intelligence for file analysis

正確答案: C,D

問題9

What role does the File Submission feature in EDR play in threat analysis?

A. It allows endpoint users to disable antivirus for file recovery

B. It initiates policy rollback before executing unknown files

C. It removes quarantined files automatically after 30 days

D. It uploads files to a cloud sandbox or analysis engine to determine their risk level

正確答案: D

問題10

What methods can administrators use to enroll endpoints into SES Complete? (Choose two)

A. Using domain-based deployment with Microsoft GPO

B. Through SEP Mobile device scans

C. Via ICDm using agent installation packages

D. By importing certificates from third-party tools

正確答案: A,C

問題11

Scenario:
A global company is deploying SES Complete across multiple remote offices. Some offices lack local servers, and devices often operate outside of the corporate network. The analyst is tasked with deploying agents efficiently and maintaining centralized control.
What are the best actions a security analyst should take to ensure endpoint protection across distributed offices?

A. Use ICDm to enforce policies across all regions

B. Enable cloud-based automatic content updates

C. Deploy agents with embedded auto-enrollment credentials

D. Configure SEPM for standalone policy management

E. Require users to manually install agents from a shared drive

正確答案: A,B,C

問題12

What function does ICDm provide to automate the removal of detected threats from endpoints?

A. Threat Remediation

B. App Control Lockdown

C. File Retrieval

D. Policy Tuning

正確答案: A

問題13

Which two steps must be completed to properly configure TDAD within SES Complete? (Choose two)

A. Install sensors on writable domain controllers

B. Enable the "Monitor Only" mode before enforcing policy

C. Assign a TDAD policy to domain-joined endpoints

D. Deploy sensors on read-only domain controllers

正確答案: A,B

最新的Broadcom Symantec Endpoint Security Complete Admin R1.4 Technical Specialist - 250-604免費考試真題

最新更新

站內鏈接

聯系我們