Broadcom 250-580 Endpoint Security Complete - R2 Technical Specialist Exam Practice Test

Answer : B, C

Symantec Endpoint Protection (SEP) may be unable to remediate a file in certain situations. Two primary reasons for this failure are:

The detected file is in use (Option B): When a file is actively being used by the system or an application, SEP cannot remediate or delete it until it is no longer in use. Active files are locked by the operating system, preventing modification.

Insufficient file permissions (Option C): SEP needs adequate permissions to access and modify files. If SEP does not have the necessary permissions for the detected file, it cannot perform remediation.

Why Other Options Are Incorrect:

Another scan in progress (Option A) does not directly prevent remediation.

File marked for deletion on restart (Option D) would typically allow SEP to complete the deletion upon reboot.

File with good reputation (Option E) is less likely to be flagged for remediation but would not prevent it if flagged.

Answer : C

Push Notification is the communication method used within Symantec Endpoint Security (SES) to facilitate real-time management. This method enables:

Immediate Updates: SES can instantly push policy changes, updates, or commands to endpoints without waiting for a standard polling interval.

Efficient Response to Threats: Push notifications allow for faster reaction times to emerging threats, as instructions can be delivered to endpoints immediately.

Reduced Resource Usage: Unlike continuous polling, push notifications are triggered as needed, reducing network and system resource demands.

Push Notification is crucial for achieving real-time management in SES, providing timely responses and updates to enhance endpoint security.

Answer : C

Administrators can use the Application Catalog in Symantec Endpoint Security to create custom behavioral isolation policies. This tool compiles data on application behavior, enabling administrators to define isolation policies that address specific behaviors observed within their environment. By leveraging the Application Catalog, administrators can tailor policies based on the behaviors of applications, enhancing the control and containment of potentially malicious activity.

Answer : B

Calculating storage requirements for Symantec Endpoint Security (SES) involves gathering specific information related to data retention and event storage needs. The required information includes:

Number of Endpoints: Determines the scale of data to be managed.

EAR Data per Endpoint per Day: Refers to the Endpoint Activity Recorder (EAR) data generated by each endpoint daily, affecting storage usage.

Number of Days to Retain: Indicates the data retention period, which impacts the total volume of stored data.

Number of Endpoint Dumps and Dump Size: These parameters define the size and number of memory dumps, which are essential for forensic analysis and troubleshooting.

This information allows accurate calculation of storage needs, ensuring adequate capacity for logs, dumps, and activity data.

Answer : B

If an administrator has enabled the setting to manage policies from the cloud and needs to reverse this, they must follow these steps:

Unenroll the SEPM (Symantec Endpoint Protection Manager) from the cloud management (ICDm).

Disable the cloud policy management setting within the SEPM.

Re-enroll the SEPM back into the cloud if required.

This process ensures that policy control is reverted from cloud management to local management on the SEPM. By following these steps, administrators restore full local control over policies, disabling any cloud-based management settings previously in effect.

Answer : D

When a policy is duplicated in Symantec Endpoint Protection (SEP), the duplicated policy is assigned a version number of 'One'. This means that the new policy starts fresh with a version number of 1, separate from the original policy's version history. The SEP system uses this new version number to track any subsequent changes to the duplicated policy independently of the original.

Answer : B

An Indicator of Compromise (IOC), such as irregularities in privileged user account activity, can signal that a privileged account may be compromised and used maliciously. This can involve deviations from typical login times, unusual commands or requests, or access to resources not typically utilized by the user. Monitoring such anomalies can help detect when an attacker has gained access to a privileged account and is attempting to establish control within the environment.