Question 1

Which two criteria can an administrator use to determine hosts in a host group? (Select two.)
A) Subnet
B) Network Services
C) Application Protocol
D) DNS Domain
E) Network Adapters

Accepted Answer

An administrator can use the subnet to group hosts that are within the same network range, and DNS domain to group hosts that belong to the same domain name system.

Question 2

How are Insight results stored?
A) encrypted on the Symantec Endpoint Protection Manager
B) unencrypted on the Symantec Endpoint Protection Manager
C) encrypted on the Symantec Endpoint Protection client
D) unencrypted on the Symantec Endpoint Protection client

Accepted Answer

The answer of How are Insight results stored?
A) encrypted on...

Question 3

A Symantec Endpoint Protection administrator is using System Lockdown in blacklist mode with a file fingerprint list. When testing a client, the administrator notices that at least one of the files on the list is allowed to execute. What is the likely cause of the problem?
A) The application has been upgraded.
B) The Application and Device Control policy is in test mode.
C) A file exception has been added to the Exceptions policy.
D) The Application and Device Control policy is allowing the file to execute.

Accepted Answer

The answer of A Symantec Endpoint Protection administrator is using...

Question 4

A threat was detected by Auto-Protect on a client system. Which command can an administrator run to determine whether additional threats exist?
A) Restart Client Computer
B) Update Content and Scan
C) Enable Network Threat Protection
D) Enable Download Insight

Accepted Answer

The answer of A threat was detected by Auto-Protect on...

Question 5

A user is unknowingly about to connect to a malicious website and download a known threat within a .rar file.  All Symantec Endpoint Protection technologies are installed on the client's system. In which feature set order must the threat pass through to successfully infect the system?
A) Download Insight, Firewall, IPS
B) Firewall, IPS, Download Insight
C) IPS, Firewall, Download Insight
D) Download Insight, IPS, Firewall

Accepted Answer

The threat must first pass through the Firewall, which controls network traffic. Then it goes through IPS (Intrusion Prevention System) for detecting and blocking malicious activities. Finally, Download Insight checks the reputation of the file being downloaded.

Question 6

A Symantec Endpoint Protection administrator must block traffic from an attacking computer for a specific time period. Where should the administrator adjust the time to block the attacking computer?
A) in the firewall policy, under Protection and Stealth
B) in the firewall policy, under Built in Rules
C) in the group policy, under External Communication Settings
D) in the group policy, under Communication Settings

Accepted Answer

The administrator should adjust the time to block the attacking computer in the firewall policy, under Protection and Stealth settings. This section allows configuration of how long to block traffic from an attacking computer.

Question 7

An administrator selects the Backup files before attempting to repair the Remediations option in the Auto-Protect policies. Which two actions occur when a virus is detected? (Select two.)
A) replace the file with a place holder
B) check the reputation
C) store in Quarantine folder
D) send the file to Symantec Insight
E) encrypt the file

Accepted Answer

The answer of An administrator selects the Backup files before...

Question 8

An administrator needs to increase the access speed for client files that are stored on a file server. Which configuration should the administrator review to address the read speed from the server?
A) Enable Network Cache in the client's Virus and Spyware Protection policy
B) Add the applicable server to a trusted host group
C) Create a Firewall allow rule for the server's IP address
D) Enable download randomization in the client group's communication settings

Accepted Answer

Enabling Network Cache in the client's Virus and Spyware Protection policy can help improve access speed by reducing the need to repeatedly scan files that have already been deemed safe, thus speeding up read operations from the server.

Question 9

A Symantec Endpoint Protection administrator needs to prevent users from modifying files in a specific program folder that is on all client machines. What does the administrator need to configure?
A) a file and folder exception in the Exception policy
B) an application rule set in the Application and Device Control policy
C) a file fingerprint list and System Lockdown
D) the Tamper Protection settings for the client folder

Accepted Answer

An application rule set in the Application and Device Control policy allows the administrator to define rules that can prevent users from modifying files in specific folders.

Question 10

An administrator is re-adding an existing Replication Partner to the local Symantec Endpoint Protection Manager site. Which two parameters are required to re-establish this replication partnership? (Select two.)
A) remote server IP Address and port
B) remote site Encryption Password
C) remote site Domain ID
D) remote server Administrator credentials
E) remote SQL database account credentials

Accepted Answer

The answer of An administrator is re-adding an existing Replication...

Question 11

An administrator configures the scan duration for a scheduled scan.  The scan fails to complete in the specified time period. When will the next scheduled scan occur on the computer?
A) when the computer reboots
B) when the user restarts the scan
C) at the next scheduled scan period
D) within the next hour

Accepted Answer

The next scheduled scan will occur at the next scheduled scan period, as the scan schedule is typically set to run at regular intervals regardless of whether the previous scan completed successfully or not.

Question 12

A company has an application that requires network traffic in both directions to multiple systems at a specific external domain. A firewall rule was created to allow traffic to and from the external domain, but the rule is blocking incoming traffic. What should an administrator enable in the firewall policy to allow this traffic?
A) TCP resequencing
B) Smart DHCP
C) Reverse DNS Lookup
D) Smart WINS

Accepted Answer

Reverse DNS Lookup can help verify the domain name associated with incoming traffic, ensuring that it matches the allowed domain and thus allowing the traffic through the firewall.

Question 13

Refer to the exhibit.  In the use case displayed in the exhibit, why is Notepad unable to save the changes to this file?
A) Tamper Protection is preventing Notepad from modifying the host file.
B) SONAR is set to block host file modifications.
C) System Lockdown is enabled.
D) SONAR High Risk detection is set to Block.

Accepted Answer

The answer of Refer to the exhibit.  In the...

Question 14

When can an administrator add a new replication partner?
A) immediately following the first LiveUpdate session of the new site
B) during a Symantec Endpoint Protection Manager upgrade
C) during the initial install of the new site
D) immediately following a successful Active Directory sync

Accepted Answer

During the initial install of the new site, an administrator can add a new replication partner.

Question 15

What is an appropriate use of a file fingerprint list?
A) allow unknown files to be downloaded with Insight
B) prevent programs from running
C) prevent AntiVirus from scanning a file
D) allow files to bypass Intrusion Prevention detection

Accepted Answer

The answer of What is an appropriate use of a...

Question 16

A Symantec Endpoint Protection (SEP) administrator creates a firewall policy to block FTP traffic and assigns the policy to all of the SEP clients.  The network monitoring team informs the administrator that a client system is making an FTP connection to a server.  While investigating the problem from the SEP client GUI, the administrator notices that there are zero entries pertaining to FTP traffic in the SEP Traffic log or Packet log.  While viewing the Network Activity dialog, there is zero inbound/outbound traffic for the FTP process. What is the most likely reason?
A) The block rule is below the blue line.
B) The server has an IPS exception for that traffic.
C) Peer-to-peer authentication is allowing the traffic.
D) The server is in the IPS policy excluded hosts list.

Accepted Answer

The answer of A Symantec Endpoint Protection (SEP) administrator creates...

Question 17

A Symantec Endpoint Protection (SEP) administrator receives multiple reports that machines are experiencing performance issues. The administrator discovers that the reports happen about the same time as the scheduled LiveUpdate. Which setting should the SEP administrator configure to minimize I/O when LiveUpdate occurs?
A) Change the LiveUpdate schedule
B) Change the Administrator-defined scan schedule
C) Disable Allow user-defined scans to run when the scan author is logged off
D) Disable Run an Active Scan when new definitions arrive

Accepted Answer

Disabling "Run an Active Scan when new definitions arrive" will reduce the immediate I/O load that occurs when LiveUpdate downloads new definitions, thus minimizing performance issues.

Question 18

In the virus and Spyware Protection policy, an administrator sets the First action to Clean risk and sets If first action fails to Delete risk. Which two factors should the administrator consider? (Select two.)
A) The deleted file may still be in the Recycle Bin.
B) IT Analytics may keep a copy of the file for investigation.
C) False positives may delete legitimate files.
D) Insight may back up the file before sending it to Symantec.
E) A copy of the threat may still be in the quarantine.

Accepted Answer

False positives may result in legitimate files being deleted, and a copy of the threat may still be in quarantine even after deletion attempts.

Question 19

Which two options are available when configuring DNS change detected for SONAR? (Select two.)
A) Block
B) Active Response
C) Quarantine
D) Log
E) Trace

Accepted Answer

Block and Log are the two options available when configuring DNS change detected for SONAR.

Question 20

What are two criteria that Symantec Insight uses to evaluate binary executables? (Select two.)
A) sensitivity
B) prevalence
C) confidentiality
D) content
E) age

Accepted Answer

The answer of What are two criteria that Symantec Insight...

Exam 1: Administration of Symantec Endpoint Protection 14 (Broadcom)

Which two criteria can an administrator use to determine hosts in a host group? (Select two.)

How are Insight results stored?

A Symantec Endpoint Protection administrator is using System Lockdown in blacklist mode with a file fingerprint list. When testing a client, the administrator notices that at least one of the files on the list is allowed to execute. What is the likely cause of the problem?

A threat was detected by Auto-Protect on a client system. Which command can an administrator run to determine whether additional threats exist?

A user is unknowingly about to connect to a malicious website and download a known threat within a .rar file. All Symantec Endpoint Protection technologies are installed on the client's system. In which feature set order must the threat pass through to successfully infect the system?

A Symantec Endpoint Protection administrator must block traffic from an attacking computer for a specific time period. Where should the administrator adjust the time to block the attacking computer?

An administrator selects the Backup files before attempting to repair the Remediations option in the Auto-Protect policies. Which two actions occur when a virus is detected? (Select two.)

An administrator needs to increase the access speed for client files that are stored on a file server. Which configuration should the administrator review to address the read speed from the server?

A Symantec Endpoint Protection administrator needs to prevent users from modifying files in a specific program folder that is on all client machines. What does the administrator need to configure?

An administrator is re-adding an existing Replication Partner to the local Symantec Endpoint Protection Manager site. Which two parameters are required to re-establish this replication partnership? (Select two.)

An administrator configures the scan duration for a scheduled scan. The scan fails to complete in the specified time period. When will the next scheduled scan occur on the computer?

Refer to the exhibit. In the use case displayed in the exhibit, why is Notepad unable to save the changes to this file?

When can an administrator add a new replication partner?

What is an appropriate use of a file fingerprint list?

In the virus and Spyware Protection policy, an administrator sets the First action to Clean risk and sets If first action fails to Delete risk. Which two factors should the administrator consider? (Select two.)

Which two options are available when configuring DNS change detected for SONAR? (Select two.)

What are two criteria that Symantec Insight uses to evaluate binary executables? (Select two.)