Question 1

A company uses a remote administration tool that is detected as Hacktool.KeyLoggPro and quarantined by Symantec Endpoint Protection (SEP). Which step can an administrator perform to continue using the remote administration tool without detection by SEP?

Options :

A : Create a Tamper Protect exception for the tool

B : Create an Application to Monitor exception for the tool

C : Create a Known Risk exception for the tool

D : Create a SONAR exception for the tool

Answer: C

Question 2

Which EDR feature is used to search for real-time indicators of compromise?

Options :

A : Domain search

B : Endpoint search

C : Cloud Database search

D : Device Group search

Answer: B

Question 3

Which SES feature helps administrators apply policies based on specific endpoint profiles?

Options :

A : Policy Bundles

B : Device Profiles

C : Policy Groups

D : Device Groups

Answer: D

Question 4

Which type of event does operation:1indicate in a SEDR database search?

Options :

A : File Deleted.

B : File Closed.

C : File Open.

D : File Created.

Answer: C

Question 5

Which security control is complementary to IPS, providing a second layer of protection against network attacks?

Options :

A : Host Integrity

B : Network Protection

C : Antimalware

D : Firewall

Answer: D

Free 250-580 Mock Exam – Practice Online Confidently

Buying Options: