250-441 Exam Dumps - Administration of Symantec Advanced Threat Protection 3.0

250-441 exam is also known as Administration of Symantec Advanced Threat Protection 3.0 exam. To help you effectively pass your Symantec 250-441 exam, Passcert provides you the gateway to success in actual Symantec Certification 250-441 Exam. Passcert coverage and accuracy are both excellent. We guarantee that using our Symantec 250-441 Exam Dumps will adequately prepare you for your 250-441 exam.

The certified candidate will demonstrate an understanding of the planning, designing, deploying and optimization of Symantec Advanced Threat Protection. This understanding serves as a basis of technical knowledge and competency for Symantec Advanced Threat Protection solutions in an enterprise environment.

To achieve this level of certification, candidates must pass the technical exam and accept the Symantec Certification Agreement.

Number of Questions: 70 - 80

Exam Duration: 90 minutes

Passing Score: 70%

Languages: English

Exam Price: $250 

EXAM SECTION 1: Cybersecurity Overview

EXAM SECTION 2: Advanced Threat Protection Overview

EXAM SECTION 3: Advanced Threat Protection Endpoint Configuration

EXAM SECTION 4: Identifying Indicators of Compromise (IOCs)

EXAM SECTION 5: Responding to Threats

EXAM SECTION 6: Recovering from an Incident

1.What is the second stage of an Advanced Persistent Threat (APT) attack?

A. Exfiltration

B. Incursion

C. Discovery

D. Capture

Answer: B

2.Which SEP technology does an Incident Responder need to enable in order to enforce blacklisting on an endpoint?

A. System Lockdown

B. Intrusion Prevention System

C. Firewall

D. SONAR

Answer: A

3.An Incident Responder wants to create a timeline for a recent incident using Syslog in addition to ATP for the After Actions Report.

What are two reasons the responder should analyze the information using Syslog? (Choose two.)

A. To have less raw data to analyze

B. To evaluate the data, including information from other systems

C. To access expanded historical data

D. To determine what policy settings to modify in the Symantec Endpoint Protection Manager (SEPM)

E. To determine the best cleanup method

Answer: BE

4.Which SEP technologies are used by ATP to enforce the blacklisting of files?

A. Application and Device Control

B. SONAR and Bloodhound

C. System Lockdown and Download Insight

D. Intrusion Prevention and Browser Intrusion Prevention

Answer: C

Explanation:

Reference: https://support.symantec.com/en_US/article.HOWTO101774.html

5.What is the role of Insight within the Advanced Threat Protection (ATP) solution?

A. Reputation-based security

B. Detonation/sandbox

C. Network detection component

D. Event correlation

Answer: A