最新なSymantec 250-441問題集（96題）、真実試験の問題を全部にカバー！

質問 1：
Which SEP technologies are used by ATP to enforce the blacklisting of files?
A. SONAR and Bloodhound
B. Application and Device Control
C. Intrusion Prevention and Browser Intrusion Prevention
D. System Lockdown and Download Insight
正解：D

質問 2：
An Incident Responder needs to remediate a group of endpoints but also wants to copy a potentially suspicious file to the ATP file store.
In which scenario should the Incident Responder copy a suspicious file to the ATP file store?
A. The responder needs to analyze with Cynic
B. The responder needs to isolate it from the network
C. The responder needs to add the file to a whitelist
D. The responder needs to write firewall rules
正解：A

質問 3：
How should an ATP Administrator configure Endpoint Detection and Response according to Symantec best practices for a SEP environment with more than one domain?
A. Create a Symantec Endpoint Protection Manager (SEPM) controller connection for each domain
B. Create a Symantec Endpoint Protection Manager (SEPM) controller connection for the primary domain
C. Create a unique Symantec Endpoint Protection Manager (SEPM) domain for ATP
D. Create an ATP manager for each Symantec Endpoint Protection Manager (SEPM) domain
正解：A

質問 4：
An ATP administrator is setting up an Endpoint Detection and Response connection.
Which type of authentication is allowed?
A. SQL authentication
B. LDAP authentication
C. Symantec Endpoint Protection Manager (SEPM) authentication
D. Active Directory authentication
正解：D

質問 5：
Where can an Incident Responder view Cynic results in ATP?
A. File Details
B. Events
C. Incident Details
D. Dashboard
正解：C

質問 6：
Which threat is an example of an Advanced Persistent Threat (APT)?
A. Flamer
B. Creeper
C. Koobface
D. Brain
正解：A

質問 7：
Which stage of an Advanced Persistent Threat (APT) attack do attackers send information back to the home base?
A. Capture
B. Incursion
C. Discovery
D. Exfiltration
正解：D

質問 8：
Which final steps should an Incident Responder take before using ATP to rejoin a remediated endpoint to the network, according to Symantec best practices?
A. Run Windows Update to patch the system with the latest service pack. Once the system is up-to-date, rejoin the computer to the production network.
B. Run an additional antivirus scan with the latest definitions. If the scan comes back as clean, rejoin the computer to the production network.
C. Use SymDiag to run a Threat Scan Analysis on the machine. Once the analysis comes back as clean, rejoin the computer to the production network.
D. Upgrade the client to the latest version of SEP. Once the client is upgraded, rejoin the computer to the production network.
正解：D