What are the prerequisite products needed when deploying ATP: Endpoint, Network, and Email?
A network control point discovered a botnet phone-home attempt in the network stream.
Which detection method identified the event?
An Incident Responder runs an endpoint search on a client group with 100 endpoints. After one day, the
responder sees the results for 90 endpoints.
What is a possible reason for the search only returning results for 90 of 100 endpoints?
An Incident responder added a files NDS hash to the blacklist.
Which component of SEP enforces the blacklist?
Which two ATP control points are able to report events that are detected using Vantage?
Enter the two control point names:
An Incident Responder notices traffic going from an endpoint to an IRC channel. The endpoint is listed in an
incident. ATP is configured in TAP mode.
What should the Incident Responder do to stop the traffic to the IRC channel?
Which prerequisite is necessary to extend the ATP: Network solution service in order to correlate email
detections?
Which stage of an Advanced Persistent Threat (APT) attack do attackers map an organization’s defenses from the inside?
Which two user roles allow an Incident Responder to blacklist or whitelist files using the ATP manager?
(Choose two.)
Exam style questions across every 250-441 domain
Last Update 1 day ago
Total Questions : 96
Start with our free 250-441 practice questions, carefully crafted to mirror the domains, phrasing, and difficulty of the real Symantec Certified Specialist exam. Each 250-441 exam question comes with a detailed rationale that explains not just which answer is correct but why the others fall short. That's how concepts stick. Use the free set to benchmark yourself: identify your Symantec weak domains, see where you're losing marks, and build a focused study plan in minutes.
