Free Endpoint Security Complete – R2 Technical Specialist Exam 250-580 Exam Practice Test

An administrator changes the Virus and Spyware Protection policy for a specific group that disables Auto-Protect. The administrator assigns the policy and the client systems apply the corresponding policy serial number. Upon visual inspection of a physical client system, the policy serial number is correct. However, Auto-Protect is still enabled on the client system.Which action should the administrator take to ensure that the desired setting is in place for the client?

• Restart the client system
• Run a command on the computer to Update Content
• Enable the padlock next to the setting in the policy
• Withdraw the Virus and Spyware Protection policy

Which protection technology can detect botnet command and control traffic generated on the Symantec Endpoint Protection client machine?

• Insight
• SONAR
• Risk Tracer
• Intrusion Prevention

Using a hybrid environment, if a SEPM-managed endpoint cannot connect to the SEPM, how quickly can an administrator receive a security alert if the endpoint is using a public hot-spot?

• After a VPN is activated with Network Integrity
• When the client connects to SEPM
• At the next heartbeat
• Immediately

What is the function of Symantec Insight?

• Provides reputation ratings for structured data
• Enhances the capability of Group Update Providers (GUP)
• Increases the efficiency and effectiveness of LiveUpdate
• Provides reputation ratings for binary executables

What happens when a device fails a Host Integrity check?

• An antimalware scan is initiated
• The device is restarted
• The device is quarantined
• An administrative notification is logged

Which Incident View widget shows the parent-child relationship of related security events?

• The Incident Summary Widget
• The Process Lineage Widget
• The Events Widget
• The Incident Graph Widget

Which report template type should an administrator utilize to create a daily summary of network threats detected?

• Intrusion Prevention Report
• Blocked Threats Report
• Network Risk Report
• Access Violation Report

In the virus and Spyware Protection policy, an administrator sets the First action to Clean risk and sets If first action fails to Delete risk. Which two (2) factors should the administrator consider? (Select two.)

• The deleted file may still be in the Recycle Bin.
• IT Analytics may keep a copy of the file for investigation.
• False positives may delete legitimate files.
• Insight may back up the file before sending it to Symantec.
• A copy of the threat may still be in the quarantine.

Which action must a Symantec Endpoint Protection administrator take before creating custom Intrusion Prevention signatures?

• Change the custom signature order
• Create a Custom Intrusion Prevention Signature library
• Define signature variables
• Enable signature logging

Which two (2) instances could cause Symantec Endpoint Protection to be unable to remediate a file? (Select two.)

• Another scan is in progress.
• The detected file is in use.
• There are insufficient file permissions.
• The file is marked for deletion by Windows on restart.
• The file has good reputation.