Crack4sure Logo
3 Months Free Update
3 Months Free Update
3 Months Free Update
Which action should an Incident Responder take to remediate false positives, according to Symantec best
practices?
What is the main constraint an ATP Administrator should consider when choosing a network scanner model?
Which final steps should an Incident Responder take before using ATP to rejoin a remediated endpoint to the network, according to Symantec best practices?
Which stage of an Advanced Persistent Threat (APT) attack does social engineering occur?
An ATP Administrator has deployed ATP: Network, Endpoint, and Email and now wants to ensure that all
connections are properly secured.
Which connections should the administrator secure with signed SSL certificates?
In which scenario would it be beneficial for an organization to eradicate a threat from the environment by deleting it?
An Incident Responder wants to use a STIX file to run an indicate of components (IOC) search.
Which format must the administrator use for the file?
What is the role of Synapse within the Advanced Threat Protection (ATP) solution?
Which two actions an Incident Responder take when downloading files from the ATP file store? (Choose two.)
An ATP administrator is setting up correlation with Email Security cloud.
What is the minimum Email Security cloud account privilege required?
ATP detects a threat phoning home to a command and control server and creates a new incident. The treat is NOT being detected by SEP, but the Incident Response team conducted an indicators of compromise (IOC) search for the machines that are contacting the malicious sites to gather more information.
Which step should the Incident Response team incorporate into their plan of action?
An ATP Administrator set up ATP: Network in TAP mode and has placed URLs on the blacklist.
What will happen when a user attempts to access one of the blacklisted URLs?
Which attribute is required when configuring the Symantec Endpoint Protection Manager (SEPM) Log
Collector?
Which endpoint detection method allows for information about triggered processes to be displayed in ATP?
While filling out the After Actions Report, an Incident Response Team noted that improved log monitoring could help detect future breaches.
What are two examples of how an organization can improve log monitoring to help detect future breaches? (Choose two.)
Which access credentials does an ARP Administrator need to set up a deployment of ATP: Endpoint , Network and Email?
What is the earliest stage at which a SQL injection occurs during an Advanced Persistent Threat (APT) attack?
Which two ATP control points are able to report events that are detected using Vantage?
Enter the two control point names:
Which two database attributes are needed to create a Microsoft SQL SEP database connection? (Choose
two.)
Which prerequisite is necessary to extend the ATP: Network solution service in order to correlate email
detections?
A large company has 150,000 endpoints with 12 SEP sites across the globe. The company now wants to
implement ATP: Endpoint to improve their security. However, a consultant recently explained that the company needs to implement more than one ATP manager.
Why does the company need more than one ATP manager?
Which SEP technology does an Incident Responder need to enable in order to enforce blacklisting on an
endpoint?
TESTED 08 Jul 2025