Deck 1: Administration of Symantec Endpoint Protection 14 (Broadcom)

Question 1

A large software company runs a small engineering department that is remotely located over a slow WAN connection. Which option should the company use to install an exported Symantec Endpoint Protection (SEP) package to the remote site using the smallest amount of network bandwidth?

A) a SEP package using Basic content
B) a SEP package using a policy defined Single Group Update Provider (GUP)
C) a SEP package using a policy defined Multiple Group Update Provider (GUP) list
D) a SEP package using the Install Packages tab

Answer 1

a SEP package using Basic content

Question 2

Which ports on the company firewall must an administrator open to avoid problems when connecting to Symantec Public LiveUpdate servers?

A) 25, 80, and 2967
B) 2967, 8014, and 8443
C) 21, 443, and 2967
D) 21, 80, and 443

Answer 2

21, 80, and 443

Question 3

Which action does the Shared Insight Cache (SIC) server take when the whitelist reaches maximum capacity?

A) The SIC server allocates additional memory for the whitelist as needed.
B) The SIC server will start writing the cache to disk.
C) The SIC server will remove the least recently used items based on the prune size.
D) The SIC server will remove items with the fewest number of votes.

Answer 3

The SIC server will remove the least recently used items based on the prune size.

Question 4

What are two supported Symantec Endpoint Protection Manager authentication types? (Select two.)

A) Microsoft Active Directory
B) MS-CHAP
C) RSA SecurID
D) Biometrics
E) Network Access Control

Question 5

Which policy should an administrator modify to enable Virtual Image Exception (VIE) functionality?

A) Host Integrity Policy
B) Virus and Spyware Protection Policy
C) Exceptions Policy
D) Application and Device Control Policy

Question 6

A company deploys Symantec Endpoint Protection (SEP) to 50 virtual machines running on a single ESXi host. Which configuration change can the administrator make to minimize sudden IOPS impact on the ESXi server while each SEP endpoint communicates with the Symantec Endpoint Protection Manager?

A) increase Download Insight sensitivity level
B) reduce the heartbeat interval
C) increase download randomization window
D) reduce number of content revisions to keep

Question 7

Which command attempts to find the name of the drive in the private region and to match it to a disk media record that is missing a disk access record?

A) vxdisk
B) vxdctl
C) vxreattach
D) vxrecover

Question 8

Employees of an accounting company often take their notebooks to customer sites. The administrator needs to apply a different firewall policy when the notebooks are disconnected from the accounting company's network. What must the administrator configure to use the two different policies?

A) Groups
B) Domains
C) Sites
D) Locations

Question 9

Which setting can an administrator configure in the LiveUpdate Policy?

A) specific content revision to download from a Group Update Provider (GUP)
B) specific content policies to download
C) Linux Settings
D) frequency to download content

Question 10

A company deploys Symantec Endpoint Protection client to its sales staff who travel across the country. Which deployment method should the company use to notify its sales staff to install the client?

A) Push mode
B) Client Deployment Wizard
C) Pull mode
D) Unmanaged Detector

Question 11

Which action should an administrator take to prevent users from using Windows Security Center?

A) set Disable antivirus alert within Windows Security Center to Disable
B) set Disable antivirus alert within Windows Security Center to Never
C) set Disable Windows Security Center to Disable
D) set Disable Windows Security Center to Always

Question 12

Refer to the exhibit. An administrator uses the search criteria displayed in the exhibit. Which results are returned from the query?

A) all Windows 2012 Servers in the Default Group
B) only VMware Servers in the Default Group
C) all Windows 2012 Servers and all Virtualized Servers in the Default Group
D) only Windows 2012 Servers that are Virtualized in the Default Group

Question 13

A company receives a high number of reports from users that files being downloaded from internal web servers are blocked.  The Symantec Endpoint Protection administrator verifies that the Automatically trust any file downloaded from an intranet website option is enabled. Which configuration can cause Insight to block the files being downloaded from the internal web servers?

A) Intrusion Prevention is disabled.
B) Local intranet zone is configured incorrectly on the Windows clients browser settings.
C) Local intranet zone is configured incorrectly on the Mac clients browser settings.
D) Virus and Spyware Definitions are out of date.

Question 14

A Symantec Endpoint Protection (SEP) client uses a management server list with three management servers in the priority 1 list. Which mechanism does the SEP client use to select an alternate management server if the currently selected management server is unavailable?

A) The client chooses another server in the list randomly.
B) The client chooses a server based on the lowest server load.
C) The client chooses a server with the next highest IP address.
D) The client chooses the next server alphabetically by server name.

Question 15

A company uses a remote administration tool that is detected and quarantined by Symantec Endpoint Protection (SEP). Which step can an administrator perform to continue using the remote administration tool without detection by SEP?

A) create a Tamper Protect exception for the tool
B) create an Application to Monitor exception for the tool
C) create a Known Risk exception for the tool
D) create a SONAR exception for the tool

Question 16

Which setting can an administrator change that will result in the greatest impact on the speed of delivery of Symantec Endpoint Protection policy changes to the endpoints?

A) Download randomization
B) Heartbeat interval
C) LiveUpdate scheduling frequency
D) Reconnection preferences

Question 17

The LiveUpdate Download Schedule is set to the default on the Symantec Endpoint Protection Manager (SEPM). How many content revisions must the SEPM keep to ensure clients that check in to the SEPM every 10 days receive xdelta content packages instead of full content packages?

A) 10
B) 20
C) 30
D) 60

Question 18

A Symantec Endpoint Protection (SEP) administrator is remotely deploying SEP clients, but the clients are failing to install on Windows XP. What are two possible reasons for preventing installation? (Select two.)

A) Windows firewall is enabled.
B) Internet Connection firewall is disabled.
C) Administrative file shares are enabled.
D) Simple file sharing is enabled.
E) Clients are configured for DHCP.

Question 19

An administrator needs to add an Application Exception. When the administrator accesses the Application Exception dialog window, applications fail to appear. What is the likely problem?

A) The Learn applications that run on the client computers setting is disabled.
B) The client computers already have exclusions for the applications.
C) The Symantec Endpoint Protection Manager is installed on a Domain Controller.
D) The clients are in a trusted Symantec Endpoint Protection domain.

Question 20

A company has 10,000 Symantec Endpoint Protection (SEP) clients deployed using two Symantec Endpoint Protection Managers (SEPMs). Which configuration is recommended to ensure that each SEPM is able to effectively handle the communications load with the SEP clients?

A) Push mode
B) Client control mode
C) Server control mode
D) Pull mode

Question 21

Which two criteria can an administrator use to determine hosts in a host group? (Select two.)

A) Subnet
B) Network Services
C) Application Protocol
D) DNS Domain
E) Network Adapters

Question 22

How are Insight results stored?

A) encrypted on the Symantec Endpoint Protection Manager
B) unencrypted on the Symantec Endpoint Protection Manager
C) encrypted on the Symantec Endpoint Protection client
D) unencrypted on the Symantec Endpoint Protection client

Question 23

A Symantec Endpoint Protection administrator is using System Lockdown in blacklist mode with a file fingerprint list. When testing a client, the administrator notices that at least one of the files on the list is allowed to execute. What is the likely cause of the problem?

A) The application has been upgraded.
B) The Application and Device Control policy is in test mode.
C) A file exception has been added to the Exceptions policy.
D) The Application and Device Control policy is allowing the file to execute.

Question 24

A threat was detected by Auto-Protect on a client system. Which command can an administrator run to determine whether additional threats exist?

A) Restart Client Computer
B) Update Content and Scan
C) Enable Network Threat Protection
D) Enable Download Insight

Question 25

A user is unknowingly about to connect to a malicious website and download a known threat within a .rar file.  All Symantec Endpoint Protection technologies are installed on the client's system. In which feature set order must the threat pass through to successfully infect the system?

A) Download Insight, Firewall, IPS
B) Firewall, IPS, Download Insight
C) IPS, Firewall, Download Insight
D) Download Insight, IPS, Firewall

Question 26

A Symantec Endpoint Protection administrator must block traffic from an attacking computer for a specific time period. Where should the administrator adjust the time to block the attacking computer?

A) in the firewall policy, under Protection and Stealth
B) in the firewall policy, under Built in Rules
C) in the group policy, under External Communication Settings
D) in the group policy, under Communication Settings

Question 27

An administrator selects the Backup files before attempting to repair the Remediations option in the Auto-Protect policies. Which two actions occur when a virus is detected? (Select two.)

A) replace the file with a place holder
B) check the reputation
C) store in Quarantine folder
D) send the file to Symantec Insight
E) encrypt the file

Question 28

An administrator needs to increase the access speed for client files that are stored on a file server. Which configuration should the administrator review to address the read speed from the server?

A) Enable Network Cache in the client's Virus and Spyware Protection policy
B) Add the applicable server to a trusted host group
C) Create a Firewall allow rule for the server's IP address
D) Enable download randomization in the client group's communication settings

Question 29

A Symantec Endpoint Protection administrator needs to prevent users from modifying files in a specific program folder that is on all client machines. What does the administrator need to configure?

A) a file and folder exception in the Exception policy
B) an application rule set in the Application and Device Control policy
C) a file fingerprint list and System Lockdown
D) the Tamper Protection settings for the client folder

Question 30

An administrator is re-adding an existing Replication Partner to the local Symantec Endpoint Protection Manager site. Which two parameters are required to re-establish this replication partnership? (Select two.)

A) remote server IP Address and port
B) remote site Encryption Password
C) remote site Domain ID
D) remote server Administrator credentials
E) remote SQL database account credentials

Question 31

An administrator configures the scan duration for a scheduled scan.  The scan fails to complete in the specified time period. When will the next scheduled scan occur on the computer?

A) when the computer reboots
B) when the user restarts the scan
C) at the next scheduled scan period
D) within the next hour

Question 32

A company has an application that requires network traffic in both directions to multiple systems at a specific external domain. A firewall rule was created to allow traffic to and from the external domain, but the rule is blocking incoming traffic. What should an administrator enable in the firewall policy to allow this traffic?

A) TCP resequencing
B) Smart DHCP
C) Reverse DNS Lookup
D) Smart WINS

Question 33

Refer to the exhibit. In the use case displayed in the exhibit, why is Notepad unable to save the changes to this file?

A) Tamper Protection is preventing Notepad from modifying the host file.
B) SONAR is set to block host file modifications.
C) System Lockdown is enabled.
D) SONAR High Risk detection is set to Block.

Question 34

When can an administrator add a new replication partner?

A) immediately following the first LiveUpdate session of the new site
B) during a Symantec Endpoint Protection Manager upgrade
C) during the initial install of the new site
D) immediately following a successful Active Directory sync

Question 35

What is an appropriate use of a file fingerprint list?

A) allow unknown files to be downloaded with Insight
B) prevent programs from running
C) prevent AntiVirus from scanning a file
D) allow files to bypass Intrusion Prevention detection

Question 36

A Symantec Endpoint Protection (SEP) administrator creates a firewall policy to block FTP traffic and assigns the policy to all of the SEP clients.  The network monitoring team informs the administrator that a client system is making an FTP connection to a server.  While investigating the problem from the SEP client GUI, the administrator notices that there are zero entries pertaining to FTP traffic in the SEP Traffic log or Packet log.  While viewing the Network Activity dialog, there is zero inbound/outbound traffic for the FTP process. What is the most likely reason?

A) The block rule is below the blue line.
B) The server has an IPS exception for that traffic.
C) Peer-to-peer authentication is allowing the traffic.
D) The server is in the IPS policy excluded hosts list.

Question 37

A Symantec Endpoint Protection (SEP) administrator receives multiple reports that machines are experiencing performance issues. The administrator discovers that the reports happen about the same time as the scheduled LiveUpdate. Which setting should the SEP administrator configure to minimize I/O when LiveUpdate occurs?

A) Change the LiveUpdate schedule
B) Change the Administrator-defined scan schedule
C) Disable Allow user-defined scans to run when the scan author is logged off
D) Disable Run an Active Scan when new definitions arrive

Question 38

In the virus and Spyware Protection policy, an administrator sets the First action to Clean risk and sets If first action fails to Delete risk. Which two factors should the administrator consider? (Select two.)

A) The deleted file may still be in the Recycle Bin.
B) IT Analytics may keep a copy of the file for investigation.
C) False positives may delete legitimate files.
D) Insight may back up the file before sending it to Symantec.
E) A copy of the threat may still be in the quarantine.

Question 39

Which two options are available when configuring DNS change detected for SONAR? (Select two.)

A) Block
B) Active Response
C) Quarantine
D) Log
E) Trace

Question 40

What are two criteria that Symantec Insight uses to evaluate binary executables? (Select two.)

A) sensitivity
B) prevalence
C) confidentiality
D) content
E) age

Question 41

Which protection technology can detect botnet command and control traffic generated on the Symantec Endpoint Protection client machine?

A) Insight
B) SONAR
C) Risk Tracer
D) Intrusion Prevention

Question 42

What is a characteristic of a Symantec Endpoint Protection (SEP) domain?

A) Each domain has its own management server and database.
B) Every administrator from one domain can view data in other domains.
C) Data for each domain is stored in its own separate SEP database.
D) Domains share the same management server and database.

Question 43

Which task is unavailable for administrative accounts that authenticate using RSA SecurID Authentication?

A) reset forgotten passwords
B) import organizational units (OU) from Active Directory
C) configure external logging
D) enable Session Based Authentication with Web Services

Question 44

Why does Power Eraser need Internet access?

A) to leverage Symantec Insight
B) to validate root certificates on all portable executables (PXE) files
C) to ensure the Power Eraser tool is the latest release
D) to look up CVE vulnerabilities

Question 45

Catastrophic hardware failure has occurred on a single Symantec Endpoint Protection Manager (SEPM) in an environment with two SEPMs. What is the quickest way an administrator can restore the environment to its original state?

A) build a new site and configure replication with the still functioning SEPM
B) install a new SEPM into the existing site
C) clone the still functioning SEPM and change the server.properties file
D) reinstall the entire SEPM environment

Question 46

An administrator is using the SylinkDrop tool to update a Symantec Endpoint Protection client install on a system. The client fails to migrate to the new Symantec Endpoint Protection Manager (SEPM), which is defined correctly in the Sylink.xml file that was exported from the SEPM. Which settings must be provided with SylinkDrop to ensure the successful migration to a new Symantec Endpoint Protection environment with additional Group Level Security Settings?

A) -s "silent"
B) -t "Tamper Protect"
C) -r "reboot"
D) -p "password"

Question 47

Which object in the Symantec Endpoint Protection Manager console describes the most granular level to which a policy can be assigned?

A) Group
B) Computer
C) User
D) Client

Question 48

Which tool should the administrator run before starting the Symantec Endpoint Protection Manager upgrade as a Symantec Best Practice?

A) collectLog.cmd
B) DBValidator.bat
C) LogExport.cmd
D) Upgrade.exe

Question 49

Which Symantec Endpoint Protection Management (SEPM) database option is the default for deployments of fewer than 1,000 clients?

A) EmbeddeD. Using the Sybase SQL Anywhere database that comes with the product
B) On SEPM: Installing Microsoft SQL on the same server as the SEPM
C) External to SEPM: Using a preexisting Microsoft SQL server in the environment
D) EmbeddeD. Using the Microsoft SQL database that comes with the product

Question 50

After several failed logon attempts, the Symantec Endpoint Protection Manager (SEPM) has locked the default admin account. An administrator needs to make system changes as soon as possible to address an outbreak, but the admin account is the only account. Which action should the administrator take to correct the problem with minimal impact to the existing environment?

A) wait 15 minutes and attempt to log on again
B) restore the SEPM from a backup
C) run the Management Server and Configuration Wizard to reconfigure the server
D) reinstall the SEPM

Question 51

What is a function of Symantec Insight?

A) provides reputation ratings for structured data
B) enhances the capability of Group Update Providers (GUP)
C) increases the efficiency and effectiveness of LiveUpdate
D) provides reputation ratings for binary executables

Question 52

Which protection engine should be enabled to drop malicious vulnerability scans against a client system?

A) SONAR
B) Intrusion Prevention
C) Tamper Protection
D) Application and Device Control

Question 53

A large-scale virus attack is occurring and a notification condition is configured to send an email whenever viruses infect five computers on the network. A Symantec Endpoint Protection administrator has set a one hour damper period for that notification condition. How many notifications does the administrator receive after 30 computers are infected in two hours?

A) 1
B) 2
C) 6
D) 15

Question 54

Administrators at a company share a single terminal for configuring Symantec Endpoint Protection. The administrators want to ensure that each administrator using the console is forced to authenticate using their individual credentials. They are concerned that administrators may forget to log off the terminal, which would easily allow others to gain access to the Symantec Endpoint Protection Manager (SEPM) console. Which setting should the administrator disable to minimize the risk of non-authorized users logging into the SEPM console?

A) allow users to save credentials when logging on
B) delete clients that have not connected for specified time
C) lock account after the specified number of unsuccessful logon attempts
D) allow administrators to reset the passwords

Question 55

Which two considerations must an administrator make when enabling Application Learning in an environment? (Select two.)

A) Application Learning can generate increased false positives.
B) Application Learning should be deployed on a small group of systems in the enterprise.
C) Application Learning can generate significant CPU or memory use on a Symantec Endpoint Protection Manager.
D) Application Learning requires a file fingerprint list to be created in advance.
E) Application Learning is dependent on Insight.

Question 56

Which Symantec Endpoint Protection defense mechanism provides protection against threats that propagate from system to system through the use of autorun.inf files?

A) Application and Device Control
B) SONAR
C) TruScan
D) Host Integrity

Question 57

What is a function of the Symantec Endpoint Protection client?

A) uploads logs to the Shared Insight Cache
B) sends and receives application reputation ratings from LiveUpdate
C) downloads virus content updates from Symantec Insight
D) provides a Lotus Notes email scanner

Question 58

A Symantec Endpoint Protection (SEP) administrator performed a disaster recovery without a database backup. In which file should the SEP administrator add "scm.agent.groupcreation=true" to enable the automatic creation of client groups?

A) settings.conf
B) conf.properties
C) catalina.out
D) httpd.conf

Question 59

An administrator uses ClientSideClonePrepTool to clone systems and virtual machine deployment. What will the tool do when it is run on each system?

A) Run Microsoft SysPrep and removes all AntiVirus/AntiSpyware definitions
B) Disable Tamper Protect and deploys a Sylink.xml
C) Add a new Extended File Attribute value to all existing files
D) Remove unique Hardware IDs and GUIDs from the system

Question 60

The Security Status on the console home page is failing to alert a Symantec Endpoint Protection (SEP) administrator when virus definitions are out of date. How should the SEP administrator enable the Security Status alert?

A) lower the Security Status thresholds
B) raise the Security Status thresholds
C) change the Notifications setting to "Show all notifications"
D) change the Action Summary display to "By number of computers"

Question 61

Where in the Symantec Endpoint Protection (SEP) management console will a SEP administrator find the option to allow all users to enable and disable the client firewall?

A) Client User Interface Control Settings
B) Overview in Firewall Policy
C) Settings in Intrusion Prevention Policy
D) System Lockdown in Group Policy

Question 62

An administrator changes the Virus and Spyware Protection policy for a specific group that disables Auto-Protect. The administrator assigns the policy and the client systems applies the corresponding policy serial number. Upon visual inspection of a physical client system, the policy serial number is correct. However, Auto-Protect is still enabled on the client system. Which action should the administrator take to ensure that the desired setting is in place on the client?

A) Restart the client system
B) Run a command on the computer to Update Content
C) Enable the padlock next to the setting in the policy
D) Withdraw the Virus and Spyware Protection policy

Question 63

Which two sources can a Macintosh client use to download content? (Select two.)

A) Symantec Endpoint Protection Manager
B) Group Update Provider (GUP)
C) Internal LiveUpdate server
D) Default Management server
E) Symantec LiveUpdate server

Question 64

What does SONAR use to reduce false positives?

A) Virus and Spyware definitions
B) File Fingerprint list
C) Symantec Insight
D) Extended File Attributes (EFA) table

Question 65

A company has a small number of systems in their Symantec Endpoint Protection Manager (SEPM) group with federal mandates that AntiVirus definitions undergo a two week testing period. After being loaded on the client, the tested virus definitions must remain unchanged on the client systems until the next set of virus definitions have completed testing. All other clients must remain operational on the most recent definition sets. An internal LiveUpdate Server has been considered as too expensive to be a solution for this company. What should be modified on the SEPM to meet this mandate?

A) The LiveUpdate Settings policy for this group should be modified to use an Explicit Group Update Provider.
B) The LiveUpdate Content policy for this group should be modified to use a specific definition revision.
C) The SEPM site LiveUpdate settings should be modified so the Number of content revisions to keep is set to 1.
D) The SEPM site LiveUpdate settings should be modified so the Number of content revisions to keep is set to 14.

Question 66

An administrator needs to configure Secure Socket Layer (SSL) communication for clients. In the httpd.conf file, located on the Symantec Endpoint Protection Manager (SEPM), the administrator removes the hashmark (#) from the text string displayed below. #Include conf/ssl/sslForcClients.conf< Which two tasks must the administrator perform to complete the SSL configuration? (Select two.)

A) edit site.properties and change the port to 443
B) restart the Symantec Endpoint Protection Manager Webserver service
C) change the default certificates on the SEPM and reboot
D) change the Management Server List and enable HTTPs
E) change the port in Clients > Group > Policies > Settings > Communication Settings and force the clients to reconnect

Question 67

Refer to the exhibit. Which settings can impact the Files trusted count?

A) SONAR settings in the Virus and Spyware Protection policy
B) System Lockdown Whitelist in the Application and Device Control policy
C) Insight settings in the Virus and Spyware Protection policy
D) File Cache settings in the Virus and Spyware Protection policy

Question 68

An administrator is reviewing an Infected Clients Report and notices that a client repeatedly shows the same malware detection. Although the client remediates the files, the infection continues to display in the logs. Which two functions should be enabled to automate enhanced remediation of a detected threat and its related side effects? (Select two.)

A) Risk Tracer
B) Terminate Processes Automatically
C) Early Launch Anti-Malware Driver
D) Stop Service Automatically
E) Stop and Reload AutoProtect

Question 69

Multiple Windows virtual clients running on an ESX server need to be scanned daily by a scheduled scan. Which feature should an administrator use to improve scan performance on the clients?

A) Virtual Image exceptions
B) Centralized Scan exceptions
C) Download Insight
D) Tamper Protection

Question 70

Which exception type can be configured?

A) Parent Process
B) Browser Object
C) MAC Address
D) Trusted Web Domain

Question 71

A system running Symantec Endpoint Protection is assigned to a group with client user interface control settings set to mixed mode with Auto-Protect options set to Client. The user on the system is unable to turn off Auto-Protect. What is the likely cause of this problem?

A) Tamper protection is enabled.
B) System Lockdown is enabled.
C) Application and Device Control is configured.
D) The padlock on the enable Auto-Protect option is locked.

Question 72

Which client log shows that a client is downloading content from its designated source?

A) Risk Log
B) System Log
C) SesmLu.log
D) Log.LiveUpdate

Question 73

An exception needs to be created for a file named "RunMe.exe" in a user's Windows 7 "My Documents" folder. The user's login name is Bob. Which method should be used?

A) create a file exception for "RunMe.exe" with a Prefix Variable of [USERNAME]
B) create a file exception for "[Drive]:\Users\Bob\My Documents\RunMe.exe"
C) create a file exception for "*\RunMe.exe"
D) create a file exception for "RunMe.exe" with a Prefix Variable of %USERPROFILE%

Question 74

You have executed the vxdg -g diskgroup adddisk disk_name= command. Which switch needs to be added to force VxVM to take the disk media name of the failed disk and assign it to the new replacement disk?

A) -force
B) -k
C) -f
D) -assign

Question 75

Refer to the exhibit. A manufacturing company runs three shifts at their Bristol Sales office. These employees currently share desktops in the B_Desktops group. The administrators need to apply different policies/configurations for each shift. Which step should the administrator take in order to implement shift policies after switching the clients to user mode?

A) create three shift policies for the Bristol group
B) create a group for each shift of users in the Bristol group
C) turn on inheritance for all groups in England
D) turn on Active Directory integration
E) modify the B_Desktops policy

Question 76

Which tool should an administrator use to discover and deploy the Symantec Endpoint Protection client to new computers?

A) Unmanaged Detector
B) Client Deployment Wizard
C) Communication Update Package Deployment
D) Symantec Endpoint Discovery Tool

Question 77

In which two areas can host groups be used? (Select two.)

A) Application and Device Control
B) Firewall
C) Locations
D) IPS
E) Download Insight

Question 78

Which action does SONAR take before convicting a process?

A) quarantines the process
B) blocks suspicious behavior
C) reboots the system
D) checks the reputation of the process

Question 79

An administrator notices that some entries list that the Risk was partially removed. The administrator needs to determine whether additional steps are necessary to remediate the threat. Where in the Symantec Endpoint Protection Manager console can the administrator find additional information on the risk?

A) Risk log
B) Computer Status report
C) Notifications
D) Infected and At Risk Computers report

Question 80

Which feature reduces the impact of Auto-Protect on a virtual client guest operating system?

A) Network Shared Insight Cache
B) Virtual Image Exception
C) Scan Randomization
D) Virtual Shared Insight Cache