Deck 5: Symantec Messaging Gateway 10.5 Technical Assessment (Broadcom)

Question 1

With what Service and Asset Management configuration item must an asset be associated to accurately assess its value?

A) Cost Center
B) Accounting Code
C) Depreciation Schedule
D) Owner

Answer 1

Owner

Question 2

How can an administrator associate an asset with more than one owner?

A) Set the "Ownership Rule" to "Department Precedence"
B) Set the "Automatic Updating" of the Organizational Hierarchies
C) Set the "Ownership Style" to "Multiple" or "Multiple with Warning"
D) Set the "Ownership Details" to the "Edit View" for each asset type

Answer 2

Set the "Ownership Details" to the "Edit View" for each asset type

Question 3

Which item is available in the "Package Options" section of a software update policy?

A) Shut down computer after remediation
B) Allow immediate restart if required
C) Delay until the next software update cycle
D) Log off user after remediation

Answer 3

Allow immediate restart if required

Question 4

How can an administrator achieve greater efficiency and consistency when deploying multiple Managed Software Delivery policies to endpoints?

A) Configure and run the Software Portal Settings policy to update existing Managed Software Delivery policies with default settings
B) Configure the Software Catalog Item task to specify standardized settings for newly created Managed Software Delivery policies
C) Update the Managed Delivery Settings policy to define standard default settings for new Managed Delivery policies
D) Enable the Software Product Recalculation Schedule task to update existing Managed Software Delivery policies with predefined settings

Question 5

Which object can an administrator add to an organizational group?

A) User
B) Report
C) Policy
D) Data class

Question 6

An administrator has been notified that a new office location will be opening within a few weeks. The office is a large site that will have 8,000 managed endpoints. The data center is located in Lindon, Utah and the office is located in Houston, Texas. What is the minimum number of site servers needed to support the new office location?

A) Four site servers
B) Two site servers
C) One site server
D) Three site servers

Question 7

Which two (2) fields are essential to tracking assets when creating a warranty contract in IT Management Suite 8.1? (Choose two.)

A) Contract's Assigned User
B) Covered Hardware
C) Contract's Location
D) Start and End Date
E) Internal Reference

Question 8

An administrator needs to configure a policy that specifies the scheduled time and duration of when an operation can be performed on a managed computer. Which policy should the administrator use?

A) Agent Registration policy
B) Global Agent Settings policy
C) Maintenance Window policy
D) Targeted Agent Settings policy

Question 9

An administrator needs to ensure the following functionality for managed computers in an IT Management Suite 8.1 environment: - Monitoring hardware and software - Scheduling software installations and file updates - Collecting basic inventory information - Managing policies and packages Which components work together to provide this functionality for managed computers?

A) Notification Server and Symantec Management Agent
B) Symantec Management Console and Internet Gateway
C) Symantec Management Console and Symantec Management Agent
D) Notification Server and Internet Gateway

Question 10

Which website should an administrator browse to when solving Task Service Installation issues to check that the task server is up and running?

A) https://SiteServer/Altiris/ClientTaskServer/
B) https://SiteServer/Symantec/TaskServer/
C) https://SiteServer/Altiris/TaskServer/
D) https://SiteServer/ClientTaskServer/

Question 11

Which two (2) fields are essential to the tracking and reporting of an associated asset when creating a lease schedule in IT Management Suite 8.1? (Choose two.)

A) Internal Reference
B) Start Date and End Date
C) Covered Hardware
D) Contract's Assigned User
E) Contract's Location

Question 12

An administrator is in the process of defining roles within the Symantec Management Console. The administrator adds a user to a Security Role. The user can see the list of reports but cannot execute them. What must the administrator do in order for the user to be able to execute the reports?

A) Configure SQL database privileges for the role.
B) Configure Notification Server permissions for the role.
C) Configure SQL database permissions for the role.
D) Configure Notification Server privileges for the role.

Question 13

What are the components of a Notification Server report?

A) Data source, field, grid, and results
B) Data source, views, parameters, and drilldowns
C) Object, field, query, and results
D) Views, chart, grid, and drilldowns

Question 14

Which component of the Symantec Management Platform attempts to choose a new communication path when the default communication method with the Notification Server is unavailable?

A) Site Server
B) Notification Server
C) Internet Gateway
D) Symantec Management Agent

Question 15

Which action does the Symantec Management Agent perform when it receives a tickle packet?

A) It requests a policy update from the Notification Server.
B) It sends its list of package download locations to the Package Server.
C) It requests task information from a Task Server.
D) It sends basic inventory information to the Notification Server.

Question 16

Which two (2) events or methods allow the administrator to create a backup of Notification Server cryptographic keys? (Choose two.)

A) Before the installation of the Symantec Management Platform or subsequent solutions are completed
B) During the first-time installation of the Symantec products
C) After the installation of the Symantec Management Platform or subsequent solutions are completed
D) While in the Symantec Management Console by choosing Settings > All settings > Notification Server Backup
E) In the Symantec Management Console under Home > First time setup

Question 17

Which IT Analytics component allows an administrator to create reports using drag and drop functionality?

A) Cubes
B) Reports
C) Standard report builder
D) Dashboards

Question 18

An administrator is tasked with implementing an IT Management Suite 8.1 solution that will centrally manage 30,000 endpoints. Which is the best architecture to support this environment?

A) Single Notification Server
B) 1 x 6 Hierarchy
C) 1 x 2 Hierarchy
D) Two standalone Notification Servers

Question 19

Which component of IT Management Suite 8.1 can an administrator use for management of both Windows and Mac OS X based computers?

A) Deployment Solution
B) Monitor Solution
C) Workspace Virtualization
D) Real Time System Manager

Question 20

An administrator needs to quickly deploy Windows 7 to several new computers without pre-configured operating systems. The administrator decides to use an existing Ghost image since the necessary drivers have already been added to the DeployAnywhere database. The Network Boot Services configuration is set to respond only to known computers. How should the administrator proceed?

A) Configure NBS to respond to a known list of MAC addresses and deploy the images only to the new systems.
B) Deploy an Automation Folder to the new computers to prepare them for imaging.
C) Import the list of new computers into the Management Console and assign an imaging task.
D) Use an Initial Deployment Event to distribute the image as the computers boot to the network.

Question 21

A large organization wants to stagger the installation of software updates with computers in different organizational groups by installing the updates on different days. How can an administrator accomplish this without continually creating separate software update policies that target the different organizational groups?

A) Configure Site Management settings so that each organizational group downloads the software update installation files from a different package server
B) Create clones of the Default Software Update Plug-in Policy and modify the target in each policy
C) Configure an automation policy that periodically disables the Software Update Plug-in by organizational group
D) Create clones of the Windows Patch Remediation Settings and modify the target in each policy

Question 22

What tool, installed by default on the notification server, displays a runtime view of the errors, warning, information and trace messages that occur real time?

A) Altiris Perfmon
B) Altiris Profiler
C) Altiris Event Viewer
D) Altiris Log Viewer

Question 23

What component of the Symantec Management Platform defines all the information that a Symantec Management Agent would require in order to establish a connection to a Notification Server or Site Server?

A) Certificate Roll-Out
B) Communication Profile
C) Credentials Profile
D) Automation Rule

Question 24

Which agent policy contains settings to configure the alternate Notification Server URL, UNIX/Linux/Mac (ULM) settings, bandwidth throttling, and communication blockouts?

A) Global Agent Settings policies
B) Agent Registration policies
C) Targeted Agent Settings policies
D) Maintenance Windows policies

Question 25

An asset's Status value unexpectedly changes to Retired. What is the most likely IT Management Suite setting that would be the source of this status change, other than human error?

A) Purging Maintenance
B) Inventory to Asset Synchronization
C) CMDB Rules
D) Resource Merge Rule

Question 26

Which two (2) plug-ins are used by Inventory Solution to gather and monitor application-related data? (Choose two.)

A) Application Metering Agent plug-in
B) Software Update Agent plug-in
C) Inventory Agent plug-in
D) Inventory Rule Agent plug-in
E) Software Management Solution Agent plug-in

Question 27

Which installation package should an administrator use to install the Cloud-enabled Management services on an Internet-facing server?

A) Internet Gateway Installation package
B) Symantec Installation Manager package
C) Task Server Agent plug-in package
D) Symantec Management Agent package

Question 28

When investigating Driver Management Issues in Deployment Solution, an administrator tries to import a known working driver named NIC_Intel_C8121.CAB, but the Driver Manager stalls and becomes non-responsive after 5 minutes. What is the cause of the program stalling?

A) Driver manifest files are too large
B) Corrupt or missing driver manifest files
C) CAB's or EXE's are not supported
D) CAB's or EXE's are supported but take longer to import

Question 29

Which feature provides an administrator a way to discover, import, and deliver software simultaneously?

A) Software Compliance
B) Software Catalog
C) Software Library
D) Software Component

Question 30

Which two (2) IT Management Suite 8.1 features should an administrator use in order to display an alert if a specified metric indicates a problem on a server? (Choose two.)

A) Event Console
B) Event policy
C) Monitor policy
D) Notification rule
E) Automation rule

Question 31

In which two (2) locations should an administrator install the Symantec Installation Manager to facilitate the installation of IT Management Suite 8.1 on the target Notification Server? (Choose two.)

A) On the server that is to be the Notification Server to create an offline installation if this Notification Server has no internet access
B) On another server to remotely install it on the target Notification Server
C) On the server that is to be the Notification Server
D) It should be installed on a desktop class system to remotely install it on the target Notification Server
E) On another computer to create an offline installation package if the Notification Server has no internet access

Question 32

What is the maximum number of computers that could be adequately managed for an "on-box" installation of the Microsoft SQL Server with Notification Server?

A) 10,000
B) 7,500
C) 12,500
D) 5,000

Question 33

Which two (2) features are unique to IT Analytics when compared to the reporting engine built into IT Management Suite 8.1? (Choose two.)

A) Creation and display of graphical reports
B) Actionable tasks within the report results
C) Creation of key performance indicator-based dashboards
D) Use of parameters to filter report results
E) Calculation and display of trend analysis within the report results

Question 34

What is the risk to the inventory data gathered from these endpoints, if an Inventory Policy is created with the throttling period set to extend after users typically shut down computers and go home?

A) All inventory tasks will fail because they are not scheduled
B) All Inventory tasks will fail because they missed their scheduled time
C) Inventory tasks will succeed because the random start time is outside the throttling period
D) Inventory tasks will fail because they missed their random start time in the throttling period

Question 35

Which two (2) design considerations will have the most impact on the efficiency and performance of the Microsoft SQL Server when an administrator is planning an IT Management Suite 8.1 implementation? (Choose two.)

A) Hard drive configuration
B) Internet Information Services (IIS) configuration
C) Microsoft operating system version
D) Microsoft SQL Server version
E) Memory management

Question 36

An administrator needs to create an image that can be used for a mass deployment in the company. Which Deployment Solution task should the administrator perform before creating the image?

A) Run the Deploy Sysprep task before cloning
B) Run the Prepare for Image Capture task before cloning
C) Run SIDGen to prepare the image for deployment
D) Run the Capture Personality task before cloning

Question 37

An administrator is tasked with installing a site server at a small, remote site. The site will have 12 endpoints communicating with this new site server. What is the primary consideration in determining whether to install the site server with a desktop-class computer and operating system or a server-class computer and operating system?

A) The maximum amount of memory that can be installed on the computer
B) The number and size of packages to be staged on the site server
C) The frequency of tasks being executed on the clients
D) The number of concurrent TCP connections

Question 38

What Windows Task Scheduler task created by the Notification Server will improve the performance of tables in the CMDB, when solving database performance related issues?

A) NS.SQL Run Daily...
B) NS.Refresh Resource Update Summary...
C) NS.SQL defragmentation schedule...
D) NS.Weekly...

Question 39

What task, if completed, will likely fix many of the performance related issues an administrator may experience in an IT Management Suite implementation, when solving database performance related issues?

A) Implement a MS SQL Server Performance plan
B) Implement a MS SQL Server Defragmentation plan
C) Implement a MS SQL Server Optimization plan
D) Implement a MS SQL Server Maintenance plan

Question 40

How can an administrator quickly view and export report results while creating a filter based on the location of computers?

A) Executing the Filter Results Report Builder
B) Executing Assets by Location Organizational View Builder
C) Executing and saving the IT Analytics Computers by Location Report Builder
D) Executing the Computers by Location Report Builder

Question 41

An Incident Responder wants to run a database search that will list all client named starting with SYM. Which syntax should the responder use?

A) hostname like "SYM"
B) hostname "SYM"
C) hostname "SYM*"
D) hostname like "SYM*"

Question 42

What is the role of Cynic within the Advanced Threat Protection (ATP) solution?

A) Reputation-based security
B) Event correlation
C) Network detection component
D) Detonation/sandbox

Question 43

Which section of the ATP console should an ATP Administrator use to create blacklists and whitelists?

A) Reports
B) Settings
C) Action Manager
D) Policies

Question 44

Which two database attributes are needed to create a Microsoft SQL SEP database connection? (Choose two.)

A) Database version
B) Database IP address
C) Database domain name
D) Database hostname
E) Database name

Question 45

Which SEP technologies are used by ATP to enforce the blacklisting of files?

A) Application and Device Control
B) SONAR and Bloodhound
C) System Lockdown and Download Insight
D) Intrusion Prevention and Browser Intrusion Prevention

Question 46

What are two policy requirements for using the Isolate and Rejoin features in ATP? (Choose two.)

A) Add a Quarantine firewall policy for non-compliant and non-remediated computers.
B) Add a Quarantine LiveUpdate policy for non-compliant and non-remediated computers.
C) Add and assign an Application and Device Control policy in the Symantec Endpoint Protection Manager (SEPM).
D) Add and assign a Host Integrity policy in the Symantec Endpoint Protection Manager (SEPM).
E) Add a Quarantine Antivirus and Antispyware policy for non-compliant and non-remediated computers.

Question 47

What is the second stage of an Advanced Persistent Threat (APT) attack?

A) Exfiltration
B) Incursion
C) Discovery
D) Capture

Question 48

Which attribute is required when configuring the Symantec Endpoint Protection Manager (SEPM) Log Collector?

A) SEPM embedded database name
B) SEPM embedded database type
C) SEPM embedded database version
D) SEPM embedded database password

Question 49

Which action must an administrator perform before an Agentless Inventory can be run against Network Devices?

A) Import resources into the CMDB
B) A Full Inventory on all known systems
C) A Microsoft Active Directory import
D) A Network Discovery Task (Discovery Network)

Question 50

Which website should an administrator browse to when solving Package Service Installation issues to check that the endpoint can resolve to the server?

A) https://SiteServer/Altiris/PackageShare
B) https://SiteServer/Symantec/PSS
C) https://SiteServer/Symantec/PackageShare
D) https://SiteServer/Altiris/PS

Question 51

An Incident Responder wants to create a timeline for a recent incident using Syslog in addition to ATP for the After Actions Report. What are two reasons the responder should analyze the information using Syslog? (Choose two.)

A) To have less raw data to analyze
B) To evaluate the data, including information from other systems
C) To access expanded historical data
D) To determine what policy settings to modify in the Symantec Endpoint Protection Manager (SEPM)
E) To determine the best cleanup method

Question 52

Which section of the ATP console should an ATP Administrator use to evaluate prioritized threats within the environment?

A) Search
B) Action Manager
C) Incident Manager
D) Events

Question 53

Which SEP technology does an Incident Responder need to enable in order to enforce blacklisting on an endpoint?

A) System Lockdown
B) Intrusion Prevention System
C) Firewall
D) SONAR

Question 54

Why is it important for an Incident Responder to review Related Incidents and Events when analyzing an incident for an After Actions Report?

A) It ensures that the Incident is resolved, and the responder can clean up the infection.
B) It ensures that the Incident is resolved, and the responder can determine the best remediation method.
C) It ensures that the Incident is resolved, and the threat is NOT continuing to spread to other parts of the environment.
D) It ensures that the Incident is resolved, and the responder can close out the incident in the ATP manager.

Question 55

How does an attacker use a zero-day vulnerability during the Incursion phase?

A) To perform a SQL injection on an internal server
B) To extract sensitive information from the target
C) To perform network discovery on the target
D) To deliver malicious code that breaches the target

Question 56

Which best practice does Symantec recommend with the Endpoint Detection and Response feature?

A) Create a unique Cynic account to provide to ATP
B) Create a unique Symantec Messaging Gateway account to provide to ATP
C) Create a unique Symantec Endpoint Protection Manager (SEPM) administrator account to provide to ATP
D) Create a unique Email Security.cloud portal account to provide to ATP

Question 57

How should an ATP Administrator configure Endpoint Detection and Response according to Symantec best practices for a SEP environment with more than one domain?

A) Create a unique Symantec Endpoint Protection Manager (SEPM) domain for ATP
B) Create an ATP manager for each Symantec Endpoint Protection Manager (SEPM) domain
C) Create a Symantec Endpoint Protection Manager (SEPM) controller connection for each domain
D) Create a Symantec Endpoint Protection Manager (SEPM) controller connection for the primary domain

Question 58

Why is it important for an Incident Responder to analyze an incident during the Recovery phase?

A) To determine the best plan of action for cleaning up the infection
B) To isolate infected computers on the network and remediate the threat
C) To gather threat artifacts and review the malicious code in a sandbox environment
D) To access the current security plan, adjust where needed, and provide reference materials in the event of a similar incident

Question 59

Which stage of an Advanced Persistent Threat (APT) attack does social engineering occur?

A) Capture
B) Incursion
C) Discovery
D) Exfiltration

Question 60

What is the role of Insight within the Advanced Threat Protection (ATP) solution?

A) Reputation-based security
B) Detonation/sandbox
C) Network detection component
D) Event correlation

Question 61

Which two widgets can an Incident Responder use to isolate breached endpoints from the Incident details page? (Choose two.)

A) Affected Endpoints
B) Dashboard
C) Incident Graph
D) Events View
E) Actions Bar

Question 62

Which Advanced Threat Protection (ATP) component best isolates an infected computer from the network?

A) ATP: Email
B) ATP: Endpoint
C) ATP: Network
D) ATP: Roaming

Question 63

In which two locations should an Incident Responder gather data for an After Actions Report in ATP? (Choose two.)

A) Policies page
B) Action Manager
C) Syslog
D) Incident Manager
E) Indicators of compromise (IOC) search

Question 64

What is the main constraint an ATP Administrator should consider when choosing a network scanner model?

A) Throughput
B) Bandwidth
C) Link speed
D) Number of users

Question 65

Which threat is an example of an Advanced Persistent Threat (APT)?

A) Loyphish
B) Aurora
C) ZeroAccess
D) Michelangelo

Question 66

What impact does changing from Inline Block to SPAN/TAP mode have on blacklisting in ATP?

A) ATP will continue to block previously blacklisted addresses but NOT new ones.
B) ATP does NOT block access to blacklisted addresses unless block mode is enabled.
C) ATP will clear the existing blacklists.
D) ATP does NOT block access to blacklisted addresses unless TAP mode is enabled.

Question 67

Where can an Incident Responder view Cynic results in ATP?

A) Events
B) Dashboard
C) File Details
D) Incident Details

Question 68

An Incident Responder observes an incident with multiple malware downloads from a malicious domain. The domain in question belongs to one of the organization's suppliers. The organization needs access to the site to continue placing orders. ATP: Network is configured in Inline Block mode. How should the Incident Responder proceed?

A) Whitelist the domain and close the incident as a false positive
B) Identify the pieces of malware and blacklist them, then notify the supplier
C) Blacklist the domain and IP of the attacking site
D) Notify the supplier and block the site on the external firewall

Question 69

What occurs when an endpoint fails its Host Integrity check and is unable to remediate?

A) The endpoint automatically switches to using a Compliance location, where a Compliance policy is applied to the computer.
B) The endpoint automatically switches to using a System Lockdown location, where a System Lockdown policy is applied to the computer.
C) The endpoint automatically switches to using a Host Integrity location, where a Host Integrity policy is applied to the computer.
D) The endpoint automatically switches to using a Quarantine location, where a Quarantine policy is applied to the computer.

Question 70

Which prerequisite is necessary to extend the ATP: Network solution service in order to correlate email detections?

A) Email Security.cloud
B) Web security.cloud
C) Skeptic
D) Symantec Messaging Gateway

Question 71

An Incident Responder wants to investigate whether msscrt.pdf resides on any systems. Which search query and type should the responder run?

A) Database search filename "msscrt.pdf"
B) Database search msscrt.pdf
C) Endpoint search filename like msscrt.pdf
D) Endpoint search filename ="msscrt.pdf"

Question 72

How can an Incident Responder generate events for a site that was identified as malicious but has NOT triggered any events or incidents in ATP?

A) Assign a High-Security Antivirus and Antispyware policy in the Symantec Endpoint Protection Manager (SEPM).
B) Run an indicators of compromise (IOC) search in ATP manager.
C) Create a firewall rule in the Symantec Endpoint Protection Manager (SEPM) or perimeter firewall that blocks traffic to the domain.
D) Add the site to a blacklist in ATP manager.

Question 73

Which action should an Incident Responder take to remediate false positives, according to Symantec best practices?

A) Blacklist
B) Whitelist
C) Delete file
D) Submit file to Cynic

Question 74

Which two tasks should an Incident Responder complete when recovering from an incident? (Choose two.)

A) Rejoin healthy endpoints back to the network
B) Blacklist any suspicious files found in the environment
C) Submit any suspicious files to Cynic
D) Isolate infected endpoints to a quarantine network
E) Delete threat artifacts from the environment

Question 75

Which threat is an example of an Advanced Persistent Threat (APT)?

A) Koobface
B) Brain
C) Flamer
D) Creeper

Question 76

Which threat is an example of an Advanced Persistent Threat (APT)?

A) Zeus
B) Melissa
C) Duqu
D) Code Red

Question 77

What does a Quarantine Firewall policy enable an ATP Administrator to do?

A) Isolate a computer while it is manually being remediated
B) Submit files to a Central Quarantine server
C) Filter all traffic leaving the network
D) Intercept all traffic entering the network

Question 78

What is the earliest stage at which a SQL injection occurs during an Advanced Persistent Threat (APT) attack?

A) Exfiltration
B) Incursion
C) Capture
D) Discovery

Question 79

An Incident Responder runs an endpoint search on a client group with 100 endpoints. After one day, the responder sees the results for 90 endpoints. What is a possible reason for the search only returning results for 90 of 100 endpoints?

A) The search expired after one hour
B) 10 endpoints are offline
C) The search returned 0 results on 10 endpoints
D) 10 endpoints restarted and cancelled the search

Question 80

An Incident Responder notices traffic going from an endpoint to an IRC channel. The endpoint is listed in an incident. ATP is configured in TAP mode. What should the Incident Responder do to stop the traffic to the IRC channel?

A) Isolate the endpoint with a Quarantine Firewall policy
B) Blacklist the IRC channel IP
C) Blacklist the endpoint IP
D) Isolate the endpoint with an application control policy