Symantec Administration of Symantec Advanced Threat Protection 3.0

1.

Why is it important for an Incident Responder to analyze an incident during the Recovery phase?

To determine the best plan of action for cleaning up the infection To isolate infected computers on the network and remediate the threat To gather threat artifacts and review the malicious code in a sandbox environment To access the current security plan, adjust where needed, and provide reference materials in the event of a similar incident

2.

How does an attacker use a zero-day vulnerability during the Incursion phase?

To perform a SQL injection on an internal server To extract sensitive information from the target To perform network discovery on the target To deliver malicious code that breaches the target

3.

Why is it important for an Incident Responder to review Related Incidents and Events when analyzing an incident for an After Actions Report?

It ensures that the Incident is resolved, and the responder can clean up the infection. It ensures that the Incident is resolved, and the responder can determine the best remediation method. It ensures that the Incident is resolved, and the threat is NOT continuing to spread to other parts of the environment. It ensures that the Incident is resolved, and the responder can close out the incident in the ATP manager.

4.

What is the role of Cynic within the Advanced Threat Protection (ATP) solution?

Reputation-based security Event correlation Network detection component Detonation/sandbox

5.

Which section of the ATP console should an ATP Administrator use to create blacklists and whitelists?

Reports Settings Action Manager Policies

6.

How should an ATP Administrator configure Endpoint Detection and Response according to Symantec best practices for a SEP environment with more than one domain?

Create a unique Symantec Endpoint Protection Manager (SEPM) domain for ATP Create an ATP manager for each Symantec Endpoint Protection Manager (SEPM) domain Create a Symantec Endpoint Protection Manager (SEPM) controller connection for each domain Create a Symantec Endpoint Protection Manager (SEPM) controller connection for the primary domain

7.

Where can an Incident Responder view Cynic results in ATP?

Events Dashboard File Details Incident Details

8.

An Incident Responder wants to investigate whether msscrt.pdf resides on any systems. Which search query and type should the responder run?

Database search filename msscrt.pdf Database search msscrt.pdf Endpoint search filename like msscrt.pdf Endpoint search filename = msscrt.pdf

9.

What is the earliest stage at which a SQL injection occurs during an Advanced Persistent Threat (APT) attack?

Exfiltration Incursion Capture Discovery

10.

What occurs when an endpoint fails its Host Integrity check and is unable to remediate?

The endpoint automatically switches to using a Compliance location, where a Compliance policy is applied to the computer. The endpoint automatically switches to using a System Lockdown location, where a System Lockdown policy is applied to the computer. The endpoint automatically switches to using a Host Integrity location, where a Host Integrity policy is applied to the computer. The endpoint automatically switches to using a Quarantine location, where a Quarantine policy is applied to the computer.

Symantec Administration of Symantec Advanced Threat Protection 3.0

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Congratulations

COMPANY

Products

OTHERS

Partner

Symantec Administration of Symantec Advanced Threat Protection 3.0

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Answer & Solution

Answer: Option B

Solution:

Congratulations

Detail Form

COMPANY

Products

OTHERS

Partner