Free Administration of Symantec Endpoint Security – R1 Exam 250-550 Exam Practice Test

The ICDm has generated a blacklist task due to malicious traffic detection. Which SES component was utilized to make that detection?

• Antimalware
• Reputation
• Firewall
• IPS

An administrator suspects that several computers have become part of a botnet. What should the administrator do to detect botnet activity on the network?

• Enable the Command and Control Server Firewall
• Add botnet related signatures to the IPS policy's Audit Signatures list
• Enable the IPS policy's Show notification on the device setting
• Set the Antimalware policy's Monitoring Level to 4

Which SES feature helps administrator apply policies based on specific endpoint profiles?

• Device Groups
• Device Profiles
• Policy Bundles
• Policy Groups

What are the Exploit Mitigation security control's mitigation techniques designed to prevent?

• Packed file execution
• Misbehaving applications
• File-less attacks
• Rootkit downloads

Which framework, open and available to any administrator, is utilized to categorize adversarial tactics and for each phase of a cyber attack?

• MITRE RESPONSE
• MITRE ATT&CK
• MITRE ADV&NCE
• MITRE ATTACK MATRIX

Wh.ch Firewall rule components should an administrator configure to block facebook.com use during business hours?

• Action, Hosts(s), and Schedule
• Action, Application, and Schedule
• Host(s), Network Interface, and Network Service
• Application, Host(s), and Network Service

What version number is assigned to a duplicated policy?

• One
• Zero
• The original policy's number plus one
• The original policy's version numb

After editing and saving a policy, an administrator is prompted with the option to apply the edited policy to any assigned device groups. What happens to the new version of the policy if the administrator declines the option to apply it?

• The policy display is returned to edit mode
• The new version of the policy is deleted
• An unassigned version of the policy is created
• The new version of the policy is added to the "in progress" list

Which two (2) Discovery and Deploy features could an administrator use to enroll MAC endpoints? (Select two)

• Push Enroll
• A custom Installation package creator pact
• A default Direct Installation package
• Invite User
• A custom Direct installation package

Which rule types should be at the bottom of the list when an administrator adds device control rules?

• General "catch all" rules
• General "brand defined" rules
• Specific "device type" rules
• Specific "device model" rules