Pass 250-441 Exam Guide

Administration of Symantec Advanced Threat Protection 3.0 Questions and Answers

Question 5

Which stage of an Advanced Persistent Threat (APT) attack do attackers send information back to the home base?

Capture

Incursion

Discovery

Exfiltration

Question 6

Which two questions can an Incident Responder answer when analyzing an incident in ATP? (Choose two.)

Does the organization need to do a healthcheck in the environment?

Are certain endpoints being repeatedly attacked?

Is the organization being attacked by this external entity repeatedly?

Do ports need to be blocked or opened on the firewall?

Does a risk assessment need to happen in the environment?

Question 7

Which stage of an Advanced Persistent Threat (APT) attack do attackers map an organization’s defenses from the inside?

Discovery

Capture

Exfiltration

Incursion

Question 8

What is a benefit of using Microsoft SQL as the Symantec Endpoint Protection Manager (SEPM) database in regard to ATP?

It allows for Microsoft Incident Responders to assist in remediation

ATP can access the database using a log collector on the SEPM host

It allows for Symantec Incident Responders to assist in remediation

ATP can access the database without any special host system requirements