New Year Special Limited Time Flat 70% Discount offer - Ends in 0d 00h 00m 00s - Coupon code: 70spcl

Symantec 250-428 Administration of Symantec Endpoint Protection 14 Exam Practice Test

Page: 1 / 14
Total 135 questions

Administration of Symantec Endpoint Protection 14 Questions and Answers

Question 1

A Symantec Endpoint Protection Manager (SEPM) administrator notices performance issues with the SEPM server. The Client tab becomes unresponsive in the SEPM console and .DAT files accumulate in the “agentinfo” folder.

Which tool should the administrator use to gather log files to submit to Symantec Technical Support?

Options:

A.

collectLog.cmd

B.

LogExport.exe

C.

smc.exe

D.

ExportLog.vbs

Question 2

Which action does the Shared Insight Cache (SIC) server take when the whitelist reaches maximum capacity?

Options:

A.

The SIC server allocates additional memory for the whitelist as needed.

B.

The SIC server will start writing the cache to disk.

C.

The SIC server will remove the least recently used items based on the prune size.

D.

The SIC server will remove items with the fewest number of votes.

Question 3

A company needs to forward log data from Data Center A to Data Center B during off peak hours only.

How should the company architect its Symantec Endpoint Protection environment?

Options:

A.

Set up two sites and schedule replication between them during off peak hours

B.

Set up a single site and configure the clients to send their logs to the Manager during off peak hours

C.

Set up a Group Update Provider (GUP) at Data Center A and configure it to send logs during off peak hours

D.

Set up a LiveUpdate Server at Data Center A and configure it to send logs during off peak hours

Question 4

An administrator receives a browser certificate warning when accessing the Symantec Endpoint Protection Manager (SEPM) Web console.

Where can the administrator obtain the certificate?

Options:

A.

SEPM console Licenses section

B.

Admin > Servers > Configure SecureID Authentication

C.

SEPM console Admin Tasks

D.

SEPM Web Access

Question 5

Which two settings does an administrator enable to use the Risk Tracer Feature in the Virus and Spyware Protection policy? (Select two.)

Options:

A.

Firewall Policy

B.

Application and Device Control Policy

C.

Application Learning

D.

Tamper Protection

E.

IPS active response

Question 6

Which ports on the company firewall must an administrator open to avoid problems when connecting to Symantec Public LiveUpdate servers?

Options:

A.

25, 80, and 2967

B.

2967, 8014, and 8443

C.

21, 443, and 2967

D.

21, 80, and 443

Question 7

Which client log shows that a client is downloading content from its designated source?

Options:

A.

Log.LiveUpdate

B.

System Log

C.

Risk Log

D.

SesmLu.log

Question 8

Which two Symantec Endpoint Protection components are used to distribute content updates? (Select two.)

Options:

A.

Group Update Provider (GUP)

B.

Shared Insight Cache Server

C.

Symantec Protection Center

D.

Symantec Endpoint Protection Manager

E.

Symantec Insight Database

Question 9

A company has an application that requires network traffic in both directions to multiple systems at a specific external domain. A firewall rule was created to allow traffic to and from the external domain, but the rule is blocking incoming traffic.

What should an administrator enable in the firewall policy to allow this traffic?

Options:

A.

TCP resequencing

B.

Smart DHCP

C.

Reverse DNS Lookup

D.

Smart WINS

Question 10

Which Symantec Endpoint Protection Management (SEPM) database option is the default for deployments of fewer than 1,000 clients?

Options:

A.

EmbeddeD. Using the Sybase SQL Anywhere database that comes with the product

B.

On SEPM: Installing Microsoft SQL on the same server as the SEPM

C.

External to SEPM: Using a preexisting Microsoft SQL server in the environment

D.

EmbeddeD. Using the Microsoft SQL database that comes with the product

Question 11

Which package type should an administrator use to reduce a SEP environment’s footprint when considering that new SEP 14 clients will be installed on point of sale terminals?

Options:

A.

Default Standard Client

B.

Default Embedded or VDI client

C.

Default dark network client

D.

Custom Standard client

Question 12

An administrator needs to increase the access speed for client files that are stored on a file server.

Which configuration should the administrator review to address the read speed from the server?

Options:

A.

Enable Network Cache in the client’s Virus and Spyware Protection policy

B.

Add the applicable server to a trusted host group

C.

Enable download randomization in the client group’s communication settings

D.

Create a Firewall allow rule for the server’s IP address.

Question 13

An administrator is unknowingly trying to connect to a malicious website and download a known threat within a .rar file. All Symantec Endpoint Protection technologies are installed on the client’s system.

Drag and drop the technologies to the right side of the screen in the sequence necessary to block or detect the malicious file.

Question # 13

Options:

Question 14

Which action must a Symantec Endpoint Protection administrator take before creating custom Intrusion Prevention signatures?

Options:

A.

Define signature variables

B.

Enable signature logging

C.

Change the custom signature order

D.

Create a Custom Intrusion Prevention Signature library

Question 15

Why does Power Eraser need Internet access?

Options:

A.

Validate root certificates on all portable executables (PXE) files

B.

Leverage Symantec Insight

C.

Ensure the Power Eraser tool is the latest release

D.

Look up CVE vulnerabilities

Question 16

A Symantec Endpoint Protection administrator must block traffic from an attacking computer for a specific time period.

Where should the administrator adjust the time to block the attacking computer?

Options:

A.

In the group policy, under External Communication settings

B.

In the group policy, under Communication settings

C.

In the firewall policy, under Protection and Stealth

D.

In the firewall policy, under Built in Rules

Question 17

When can an administrator add a new replication partner?

Options:

A.

immediately following the first LiveUpdate session of the new site

B.

during a Symantec Endpoint Protection Manager upgrade

C.

during the initial install of the new site

D.

immediately following a successful Active Directory sync

Question 18

An administrator is recovering from a Symantec Endpoint Manager (SEPM) site failure.

Which file should the administrator use during an install of SEPM to recover the lost environment according to Symantec Disaster Recovery Best Practice documentation?

Options:

A.

Original installation log

B.

Sylink.xml file from the SEPM

C.

Settings.properties file

D.

Recovery_timestamp file

Question 19

Which two options are available when configuring DNS change detections for SONAR? (Select two.)

Options:

A.

Log

B.

Quarantine

C.

Block

D.

Active Response

E.

Trace

Question 20

Which action can an administrator take to improve the Symantec Endpoint Protection Manager (SEPM) dashboard performance and report accuracy?

Options:

A.

Rebuilding database indexes

B.

Lowering the client installation log entries

C.

Limiting the number of backups to keep

D.

Decreasing the number of content revisions to keep

Page: 1 / 14
Total 135 questions