Activedumpsnet Logo
An Incident Responder launches a search from ATP for a file hash. The search returns the results
immediately. The responder reviews the Symantec Endpoint Protection Manager (SEPM) command status and
does NOT see an indicators of compromise (IOC) search command.
How is it possible that the search returned results?
Which endpoint detection method allows for information about triggered processes to be displayed in ATP?
What are the prerequisite products needed when deploying ATP: Endpoint, Network, and Email?
What is the main constraint an ATP Administrator should consider when choosing a network scanner model?
An ATP administrator is setting up correlation with Email Security cloud.
What is the minimum Email Security cloud account privilege required?
An Incident responder added a files NDS hash to the blacklist.
Which component of SEP enforces the blacklist?
A medium-sized organization with 10,000 users at Site A and 20,000 users at Site B wants to use ATP:
Network to scan internet traffic at both sites.
Which physical appliances should the organization use to act as a network scanner at each site while using the fewest appliances and assuming typical network usage?
What should an Incident Responder do to mitigate a false positive?
Which National Institute of Standards and Technology (NIST) cybersecurity function includes Risk Assessment or Risk Management Strategy?
Which threat is an example of an Advanced Persistent Threat (APT)?
Which policies are required for the quarantine feature of ATP to work?
An Incident Responder wants to create a timeline for a recent incident using Syslog in addition to ATP for the
After Actions Report.
What are two reasons the responder should analyze the information using Syslog? (Choose two.)
While filling out the After Actions Report, an Incident Response Team noted that improved log monitoring could help detect future breaches.
What are two examples of how an organization can improve log monitoring to help detect future breaches? (Choose two.)
Which detection method identifies a file as malware after SEP has queried the file's reputation?