250-428 実際試験問題と解答 - 模擬練習 - 受験自信を増やす

Question No : 1
An administrator is recovering from a Symantec Endpoint Manager (SEPM) site failure.
Which file should the administrator use during an install of SEPM to recover the lost environment according to Symantec Disaster Recovery Best Practice documentation?

A.Original installation log
B.Sylink.xml file from the SEPM
C.Settings.properties file
D.Recovery_timestamp file

正解:
Explanation:
References: https://support.symantec.com/en_US/article.TECH160736.html

Question No : 2
A company needs to configure an Application and Device Control policy to block read/write access to all USB removable media on its Symantec Endpoint Protection (SEP) systems.
Which tool should an administrator use to format the GUID and device IDs as required by SEP?

A.CheckSum.exe
B.DevViewer.exe
C.TaskMgr.exe
D.DeviceTree.exe

正解:

Question No : 3
CORRECT TEXT
An administrator plans to implement a multi-site Symantec Endpoint Protection (SEP) deployment. The administrator needs to determine whether replication is viable without having to make network firewall changes or change defaults in SEP.
Which port should the administrator verify is open on the path of communication between the two proposed sites? (Type the port number.)

正解: 8443
Explanation:
References: https://support.symantec.com/en_US/article.HOWTO81103.html

Question No : 4
Which package type should an administrator use to reduce a SEP environment’s footprint when considering that new SEP 14 clients will be installed on point of sale terminals?

A.Default Standard Client
B.Default Embedded or VDI client
C.Default dark network client
D.Custom Standard client

正解:
Explanation:
References: https://support.symantec.com/en_US/article.HOWTO125381.html

Question No : 5
Why is Notepad unable to save the changes to the file in the image below?

A.SONAR High Risk detection is set to Block
B.SONAR is set to block host file modifications.
C.Tamper Protection is preventing Notepad from modifying the host file.
D.System Lockdown is enabled.

正解:

Question No : 6
Why does Power Eraser need Internet access?

A.Validate root certificates on all portable executables (PXE) files
B.Leverage Symantec Insight
C.Ensure the Power Eraser tool is the latest release
D.Look up CVE vulnerabilities

正解:
Explanation:
References: https://support.symantec.com/en_US/article.TECH134803.html

Question No : 7
A Symantec Endpoint Protection (SEP) administrator performed a disaster recovery without a database backup.
In which file should the SEP administrator add “scm.agent.groupcreation=true” to enable the automatic creation of client groups?

A.conf.properties
B.httpd.conf
C.settings.conf
D.catalina.out

正解:
Explanation:
References: https://support.symantec.com/en_US/article.TECH160736.html

Question No : 8
A company uses a remote administration tool that is detected and quarantined by Symantec Endpoint Protection (SEP).
Which step can an administrator perform to continue using the remote administration tool without detection by SEP?

A.Create a Tamper Protect exception for the tool
B.Create a SONAR exception for the tool
C.Create an Application to Monitor exception for the tool
D.Create a Known Risk exception for the tool

正解:

Question No : 9
An administrator is re-adding an existing Replication Partner to the local Symantec Endpoint Protection Manager site.
Which two parameters are required to re-establish this replication partnership? (Select two.)

A.Remote site Encryption Password
B.Remote server IP Address and port
C.Remote SQL database account credentials
D.Remote server Administrator credentials
E.Remote site Domain ID

正解:
Explanation:
References: https://support.symantec.com/en_US/article.TECH104455.html

Question No : 10
Which action does SONAR take before convicting a process?

A.Checks the reputation of the process
B.Restarts the system
C.Quarantines the process
D.Blocks suspicious behavior

正解:

Question No : 11
A company allows users to create firewall rules. During the course of business, users are accidentally adding rules that block a custom internal application.
Which steps should the Symantec Endpoint Protection administrator take to prevent users from blocking the custom application?

A.Create an Allow All Firewall rule for the fingerprint of the file and place it at the bottom of the firewall rules above the blue line
B.Create an Allow firewall rule for the application and place it at the bottom of the firewall rules below the blue line
C.Create an Allow for the network adapter type used by the application and place it at the top of the firewall rules below the blue line.
D.Create an Allow Firewall rule for the application and place it at the top of the firewall rules above the blue line.

正解:
Explanation:
References: https://support.symantec.com/en_US/article.TECH104433.html

Question No : 12
Which tool should the administrator run before starting the Symantec Endpoint Protection Manager upgrade according to best practices?

A.CollectLog.cmd
B.DBValidator.bat
C.LogExport.cmd
D.Upgrade.exe

正解:
Explanation:
References: https://support.symantec.com/en_US/article.TECH240591.html

Question No : 13
Which action must a Symantec Endpoint Protection administrator take before creating custom Intrusion Prevention signatures?

A.Define signature variables
B.Enable signature logging
C.Change the custom signature order
D.Create a Custom Intrusion Prevention Signature library

正解:
Explanation:
References: https://support.symantec.com/en_US/article.HOWTO80877.html

Question No : 14
A Symantec Endpoint Protection (SEP) administrator receives multiple reports that machines are experiencing performance issues. The administrator discovers that the reports happen about the same time as the scheduled LiveUpdate.
Which setting should the SEP administrator configure to minimize I/O when LiveUpdate occurs?

A.Disable Allow user-defined scans to run when the scan author is logged off
B.Change the LiveUpdate schedule
C.Disable Run an Active Scan when new definitions arrive
D.Change the Administrator-defined scan schedule

正解:

Question No : 15
An administrator is responsible for the Symantec Endpoint Protection architecture of a large, multinational company with three regionalized data centers. The administrator needs to collect data from clients; however, the collected data must stay in the local regional data center. Communication between the regional data centers is allowed 20 hours a day.
How should the administrator architect this organization?

A.Set up 3 domains
B.Set up 3 sites
C.Set up 3 groups
D.Set up 3 locations

正解:
Explanation:
References: https://support.symantec.com/en_US/article.HOWTO80764.html

Symantec 250-428 問題練習