250-580

250-580 practice questions, page 5 of 6, with answer review and explanations.

Question 21

An organization identifies a threat in its environment and needs to limit the spread of the threat. How should the SEP Administrator block the threat using Application and Device Control?

  1. Gather the MD5 hash of the file and create an Application Content Rule that blocks the file based on the file fingerprint.
  2. Gather the process name of the file and create an Application Content Rule that blocks the file based on the device ID type.
  3. Gather the MD5 hash of the file and create an Application Content Rule that uses regular expression matching.
  4. Gather the MD5 hash of the file and create an Application Content Rule that blocks the file based on specific arguments.

Question 22

What protection technology should an administrator enable to prevent double executable file names of ransomware variants like Cryptolocker from running?

  1. Download Insight
  2. Intrusion Prevention System
  3. SONAR
  4. Memory Exploit Mitigation

Question 23

What priority would an incident that may have an impact on business be considered?

  1. Low
  2. Critical
  3. High
  4. Medium

Question 24

What methods should an administrator utilize to restore communication on a client running SEP for Mac?

  1. Use Client Deployment Wizard to push out a communications package.
  2. Use the Sylink Drop Tool on the SEPM.
  3. Use SSH and run the command: sudo launchctl load /Library/LaunchDaemons/com.symantec.symdaemon.*plist
  4. Use Third Party Deployment to push out a communications package.

Question 25

An administrator is investigating a possible threat that occurs during the Windows startup. A file is observed that is NOT digitally signed by Microsoft. Which Anti-malware feature should the administrator enable to scan this file for threats?

  1. Enable Early Launch Antimalware
  2. Enable Auto-Protect
  3. Enable Behavioral Analysis
  4. Enable Microsoft ELAM