250-441 Administration of Symantec Advanced Threat Protection 3.0 Questions and Answers

The search runs and returns results in ATP and then displays them in SEPM.

This is only an endpoint search.

This is a database search; a command is NOT sent to SEPM for this type of search.

The browser cached result from a previous search with the same criteria.

There is a file on a USB that an Incident Responder wants to analyze in a sandbox.

An Incident Responder is unable to remember the password to the .zip archive.

The file has generated multiple incidents in the ATP manager and an Incident Responder wants to blacklist the file.

The file is a legitimate application and an Incident Responder wants to report it to Symantec as a false

positive.

Discovery

Capture

Exfiltration

Incursion

Add a Quarantine firewall policy for non-compliant and non-remediated computers.

Add a Quarantine LiveUpdate policy for non-compliant and non-remediated computers.

Add and assign an Application and Device Control policy in the Symantec Endpoint Protection Manager

(SEPM).

Add and assign a Host Integrity policy in the Symantec Endpoint Protection Manager (SEPM).

Add a Quarantine Antivirus and Antispyware policy for non-compliant and non-remediated computers.

Add to Whitelist

Run an indicators of compromise (IOC) search

Submit to VirusTotal

Submit to Cynic

Policies page

Action Manager

Syslog

Incident Manager

Indicators of compromise (IOC) search

Whitelist the domain and close the incident as a false positive

Identify the pieces of malware and blacklist them, then notify the supplier

Blacklist the domain and IP of the attacking site

Notify the supplier and block the site on the external firewall

Use the Cynic portal to check whether the MD5 hash triggers a detection from Cynic

Use the ATP console to check whether the SHA-256 hash triggers a detection from Cynic

Use the ATP console to check whether the MD5 hash triggers a detection from Cynic

Use the Cynic portal to check whether the SHA-256 hash triggers a detection from Cynic

Reputation-based security

Event correlation

Network detection component

Detonation/sandbox

hostname like “SYM”

hostname “SYM”

hostname “SYM*”

hostname like “SYM*”

Exfiltration

Incursion

Capture

Discovery