250-580 試験問題を無料オンラインアクセス

After several failed logon attempts, the Symantec Endpoint Protection Manager (SEPM) has locked the default admin account. An administrator needs to make system changes as soon as possible to address an outbreak, but the admin account is the only account.
Which action should the administrator take to correct the problem with minimal impact on the existing environment?

• A.Restore the SEPM from a backup
• B.Reinstall the SEPM
• C.Wait 15 minutes and attempt to log on again
• D.Run the Management Server and Configuration Wizard to reconfigure the server

Which type of communication is blocked, when isolating the endpoint by clicking on the isolate button in SEDR?

• A.Only Web and UNC network communications
• B.All non-SEP and non-SEDR network communications
• C.All network communications
• D.Only SEP and SEDR network communications

Which designation should an administrator assign to the computer configured to find unmanaged devices?

• A.Discovery Agent
• B.Discovery Device
• C.Discovery Broker
• D.Discovery Manager

Why is it important for an Incident Responder to copy malicious files to the SEDR file store or create an image of the infected system during the Recovery phase?

• A.To create custom IPS signatures
• B.To have a copy of the file for policy enforcement
• C.To document and preserve any pieces of evidence associated with the incident
• D.To test the effectiveness of the current assigned policy settings in the Symantec Endpoint ProtectionManager (SEPM)

A file has been identified as malicious.
Which feature of SEDR allows an administrator to manually block a specific file hash?

• A.Playbooks
• B.Quarantine
• C.Allow List
• D.Block List