Free Endpoint Security Complete - Administration R1 - 250-561 Exam Questions and Answers

Which item must an administrator generate in ICDm before an on-premises Symantec Endpoint Protection Manager (SEPM) domain can be enrolled for hybrid management?

• AA. A Group Update Provider list
• BB. A LiveUpdate Administrator key
• CC. An enrollment token
• DD. A replication partner certificate

Which framework does ICDm use to categorize the attacker techniques observed in an EDR incident?

• AA. OWASP Top 10
• BB. Lockheed Martin Cyber Kill Chain
• CC. MITRE ATT&CK
• DD. NIST Cybersecurity Framework

While investigating an ICDm incident, an administrator sees an event in which powershell.exe ran an encoded command. The administrator needs to determine which parent process launched powershell.exe. Where should the administrator look?

• AA. The Security Summary report for the last 7 days
• BB. The antimalware scan history of the device
• CC. The process lineage shown in the event details
• DD. The policy assignment history of the device group

Which Attack Surface Reduction capability places decoy files and objects on endpoints so that attacker activity against them can be detected?

• AA. Intrusion Prevention
• BB. Deception
• CC. Device Control
• DD. Application Isolation

An organization manages 4,000 endpoints with an on-premises Symantec Endpoint Protection Manager (SEPM). The clients already run a version that supports hybrid management. The administrator wants these devices to use EDR in ICDm without redeploying the clients. What should the administrator do?

• AA. Change the management server list on each client to the ICDm address
• BB. Enroll the SEPM domain in ICDm using an enrollment token
• CC. Import the SEPM policies into ICDm and assign them to a new device group
• DD. Export cloud-managed install packages from ICDm and push them with SEPM

A threat intelligence report lists the SHA-256 hash of a malicious tool. An administrator needs to determine whether any device in the tenant executed that file during the past 30 days. What should the administrator do?

• AA. Search the recorded EDR process events for the hash
• BB. Run a full scan on every device group
• CC. Add the hash to a deny list policy and review new detections
• DD. Filter the Security Summary report by the file name

An administrator plans to use Adaptive Protection to restrict abuse of trusted tools such as PowerShell and PsExec. The IT operations team runs these tools daily, and the administrator must avoid interrupting their work. What should the administrator do first?

• AA. Review the behavior prevalence data before denying any behavior
• BB. Set every behavior to Deny on all device groups
• CC. Exclude the IT operations device group from Adaptive Protection
• DD. Add PowerShell and PsExec to a deny list policy

An administrator reviews detections in ICDm and finds that a file with SHA-256 hash 9f2c…e41a was blocked on three devices in the Finance group. Threat research confirms the file is malicious. The administrator must stop the file from running on every device in the tenant, including devices where it has not been seen. What should the administrator do?

• AA. Quarantine the three affected devices from the device details page
• BB. Add the hash to a deny list policy assigned to all device groups
• CC. Add the hash to a deny list policy assigned to the Finance group
• DD. Run the Delete File command on the three affected devices

An ICDm incident shows that winword.exe on a file server started a PowerShell process that connected to an external IP address. The server hosts shared files for 200 users. The security team wants to stop the server from reaching other hosts on the network right away. The Symantec agent must keep communicating with ICDm so the investigation can continue. Which action should the administrator take?

• AA. Add powershell.exe to a deny list policy for the device group
• BB. Run a full scan on the device from ICDm
• CC. Quarantine the device from ICDm
• DD. Move the device to a device group with a stricter Intrusion Prevention policy

Which Symantec Endpoint Security Complete technology monitors trusted applications and blocks behaviors that attackers commonly abuse, such as a document editor launching a command shell?

• AA. Intrusion Prevention
• BB. Adaptive Protection
• CC. Device Control
• DD. Application Isolation