Download Administration of Symantec Advanced Threat Protection 3.0.250-441.ActualTests.2019-09-22.47q.vcex

ProfExam Suite - Black Friday
Vendor: Symantec
Exam Code: 250-441
Exam Name: Administration of Symantec Advanced Threat Protection 3.0
Date: Sep 22, 2019
File Size: 114 KB
Download Exam

How to open VCEX files?

Files with VCEX extension can be opened by ProfExam Simulator.

Download
ProfExam Simulator

Purchase
Coupon: EXAM_HUB

Discount: 20%

ProfExam Simulator ProfExam Simulator ProfExam Simulator ProfExam Simulator ProfExam Simulator

Demo Questions

Question 1
Which section of the ATP console should an ATP Administrator use to evaluate prioritized threats within the environment? 
  1. Search
  2. Action Manager
  3. Incident Manager
  4. Events
Correct answer: B
Question 2
Which stage of an Advanced Persistent Threat (APT) attack does social engineering occur?
  1. Capture
  2. Incursion
  3. Discovery
  4. Exfiltration
Correct answer: B
Explanation:
Question 3
Why is it important for an Incident Responder to analyze an incident during the Recovery phase?
  1. To determine the best plan of action for cleaning up the infection
  2. To isolate infected computers on the network and remediate the threat
  3. To gather threat artifacts and review the malicious code in a sandbox environment
  4. To access the current security plan, adjust where needed, and provide reference materials in the event of a similar incident
Correct answer: D
Question 4
Which two database attributes are needed to create a Microsoft SQL SEP database connection? (Choose two.)
  1. Database version
  2. Database IP address
  3. Database domain name
  4. Database hostname
  5. Database name
Correct answer: BD
Question 5
How does an attacker use a zero-day vulnerability during the Incursion phase?
  1. To perform a SQL injection on an internal server
  2. To extract sensitive information from the target
  3. To perform network discovery on the target
  4. To deliver malicious code that breaches the target 
Correct answer: D
Explanation:
Reference: https://www.symantec.com/connect/blogs/guide-zero-day-exploits
Reference: https://www.symantec.com/connect/blogs/guide-zero-day-exploits
Question 6
Why is it important for an Incident Responder to review Related Incidents and Events when analyzing an incident for an After Actions Report?
  1. It ensures that the Incident is resolved, and the responder can clean up the infection.
  2. It ensures that the Incident is resolved, and the responder can determine the best remediation method.
  3. It ensures that the Incident is resolved, and the threat is NOT continuing to spread to other parts of the environment.
  4. It ensures that the Incident is resolved, and the responder can close out the incident in the ATP manager.
Correct answer: C
Question 7
An Incident Responder wants to investigate whether msscrt.pdf resides on any systems. 
Which search query and type should the responder run?
  1. Database search filename “msscrt.pdf”
  2. Database search msscrt.pdf
  3. Endpoint search filename like msscrt.pdf
  4. Endpoint search filename =“msscrt.pdf”
Correct answer: A
Explanation:
Question 8
What is the earliest stage at which a SQL injection occurs during an Advanced Persistent Threat (APT) attack?
  1. Exfiltration
  2. Incursion
  3. Capture
  4. Discovery
Correct answer: B
Question 9
What occurs when an endpoint fails its Host Integrity check and is unable to remediate?
  1. The endpoint automatically switches to using a Compliance location, where a Compliance policy is applied to the computer.
  2. The endpoint automatically switches to using a System Lockdown location, where a System Lockdown policy is applied to the computer.
  3. The endpoint automatically switches to using a Host Integrity location, where a Host Integrity policy is applied to the computer.
  4. The endpoint automatically switches to using a Quarantine location, where a Quarantine policy is applied to the computer.
Correct answer: D
Question 10
Which two tasks should an Incident Responder complete when recovering from an incident? (Choose two.)
  1. Rejoin healthy endpoints back to the network
  2. Blacklist any suspicious files found in the environment
  3. Submit any suspicious files to Cynic
  4. Isolate infected endpoints to a quarantine network 
  5. Delete threat artifacts from the environment
Correct answer: BE
CONNECT US
HOW TO OPEN VCE FILES

Use VCE Exam Simulator to open VCE files
Avanaset

HOW TO OPEN VCEX AND EXAM FILES

Use ProfExam Simulator to open VCEX and EXAM files
ProfExam Screen

ProfExam
ProfExam at a 20% markdown

You have the opportunity to purchase ProfExam at a 20% reduced price

Get Now!