Question 1

Which Endpoint Setting should an administrator utilize to locate unmanaged endpoints on a network subnet?

Options :

A : Device Discovery

B : Endpoint Enrollment

C : Discover and Deploy

D : Discover Endpoints

Answer: C

Question 2

What does the MITRE ATT&CK Matrix consist of?

Options :

A : Problems and Solutions

B : Attackers and Techniques

C : Tactics and Techniques

D : Entities and Tactics

Answer: C

Question 3

What are the two (2) locations where an Incident Responder should gather data for an After Actions Report in SEDR? (Select two)

Options :

A : Incident Manager

B : Policies

C : Syslog

D : Action Manager

E : Endpoint Search

Answer: A,C

Question 4

A company uses a remote administration tool that is detected as Hacktool.KeyLoggPro and quarantined by Symantec Endpoint Protection (SEP). Which step can an administrator perform to continue using the remote administration tool without detection by SEP?

Options :

A : Create a Tamper Protect exception for the tool

B : Create an Application to Monitor exception for the tool

C : Create a Known Risk exception for the tool

D : Create a SONAR exception for the tool

Answer: C

Question 5

What information is required to calculate retention rate?

Options :

A :

Number of endpoints, EAR data per endpoint per day, available disk space, number of endpoint dumps, dump size

B : Number of endpoints, available bandwidth, available disk space, number of endpoint dumps, dump size

C :

Number of endpoints, available bandwidth, number of days to retain, number of endpoint dumps, dump size

D :

Number of endpoints, EAR data per endpoint per day, number of days to retain, number of endpoint dumps, dump size

Answer: D

Free 250-580 Mock Exam – Practice Online Confidently

Buying Options: