250-604 試験問題を無料オンラインアクセス

How does the Endpoint Activity Recorder assist with threat investigation in EDR?

• A.It provides real-time snapshots of system processes and behaviors
• B.It blocks zero-day threats in real time
• C.It encrypts forensic logs before transmission
• D.It replaces all log data with summarized event details

Scenario:
An endpoint in your environment has triggered a high-severity EDR alert. The analyst identifies an unknown executable running on the system, and the behavior suggests lateral movement attempts.
Which immediate action in ICDm should the analyst perform?

• A.Submit the executable to the sandbox for future inspection
• B.Quarantine the endpoint to halt potential spread
• C.Deactivate the endpoint's firewall
• D.Archive the alert and generate a compliance report

What role does the File Submission feature in EDR play in threat analysis?

• A.It initiates policy rollback before executing unknown files
• B.It uploads files to a cloud sandbox or analysis engine to determine their risk level
• C.It removes quarantined files automatically after 30 days
• D.It allows endpoint users to disable antivirus for file recovery

What is the recommended first step when planning a migration of SEPM policies to the ICDm platform within a hybrid deployment?

• A.Immediately disconnect SEPM from all managed endpoints.
• B.Review and map existing SEPM policies to ICDm equivalents for consistent functionality.
• C.Disable all SEPM firewall rules and recreate them in ICDm.
• D.Export all device group configurations and import into ICDm.

Which policy should an administrator edit to utilize the Symantec LiveUpdate server for pre-release content?

• A.The System Policy
• B.The System Schedule Policy
• C.The Firewall Policy
• D.The LiveUpdate Policy