Endpoint Security Complete - Administration R2 (250-580) Free Practice Test

Question 1

An organization has several Symantec Endpoint Protection Management (SEPM) Servers without access to the internet. The SEPM can only run LiveUpdate within a specified "maintenance window" outside of business hours.
What content distribution method should the organization utilize?

A. Group Update Provider

B. External LiveUpdate

C. JDB file

D. Internal LiveUpdate

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

What methods should an administrator utilize to restore communication on a client running SEP for Mac?

A. Use Client Deployment Wizard to push out a communications package.

B. Use Third Party Deployment to push out a communications package.

C. sudo launchct1 load /Library/LaunchDaemons/eom.Symantec.symdaemon.'plist

D. Use the Sylink Drop Tool on the SEPM.

E. Use SSH and run the command:

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

A Symantec Endpoint Protection (SEP) administrator receives multiple reports that machines are experiencing performance issues. The administrator discovers that the reports happen at about the same time as the scheduled LiveUpdate.
Which setting should the SEP administrator configure to minimize I/O when LiveUpdate occurs?

A. Change the Administrator-defined scan schedule

B. Disable Run an Active Scan when new definitions arrive

C. Disable Allow user-defined scans to run when the scan author is logged off

D. Change the LiveUpdate schedule

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Which security control is complementary to IPS, providing a second layer of protection against network attacks?

A. Firewall

B. Host Integrity

C. Network Protection

D. Antimalware

Correct Answer: A

Question 5

What does an end-user receive when an administrator utilizes the Invite User feature to distribute the SES client?

A. An email with a link to a KB article explaining how to install the SES Agent

B. An email with a link to directly download the SES client

C. An email with a link to register on the ICDm user portal

D. An email with the SES_setup.zip file attached

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

What version number is assigned to a duplicated policy?

A. One

B. The original policy's version number

C. Zero

D. The original policy's number plus one

Correct Answer: A

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

Which Indicator of Compromise might be detected as variations in the behavior of privileged users that indicate that their account is being used by someone else to gain a foothold in an environment?

A. Mismatched Port - Application Traffic

B. Irregularities in Privileged User Account Activity

C. Surges in Database Read Volume

D. Geographical Irregularities

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

Which security control performs a cloud lookup on files downloaded during the Initial Access phase?

A. Exploit Protection

B. Antimalware

C. Intrusion Prevention

D. Auto-Protect

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

Symantec Endpoint Security Complete - Administration R2 (250-580) Free Practice Test