250-580

250-580 practice questions, page 2 of 6, with answer review and explanations.

Question 6

Which type of security threat continues to threaten endpoint security after a system reboot?

  1. file-less
  2. memory attack
  3. script
  4. Rootkit

Question 7

An organization is considering a single site for their Symantec Endpoint Protection environment. What are two reasons that the organization should consider? (Choose two.)

  1. Organizational merger
  2. Sufficient WAN bandwidth
  3. Delay-free, centralized reporting
  4. 24x7 admin availability
  5. Legal constraints

Question 8

In the virus and Spyware Protection policy, an administrator sets the First action to Clean risk and sets If first action fails to Delete risk. Which two factors should the administrator consider? (Choose two.)

  1. The deleted file may still be in the Recycle Bin.
  2. IT Analytics may keep a copy of the file for investigation.
  3. False positives may delete legitimate files.
  4. Insight may back up the file before sending it to Symantec.
  5. A copy of the threat may still be in the quarantine.

Question 9

When a SEPM is enrolled in ICDm, which policy can only be managed from the cloud?

  1. LiveUpdate
  2. Firewall
  3. Network Intrusion Prevention
  4. Intensive Protection

Question 10

What is the purpose of a Threat Defense for Active Directory Deceptive Account?

  1. It prevents attackers from reading the contents of the Domain Admins Group
  2. It assigns a fake NTLM password hash value for users with an assigned AdminCount attribute.
  3. It exposes attackers as they seek to gather credential information from workstation memory
  4. It acts as a honeypot to expose attackers as they attempt to build their AD treasure map