Which two (2) considerations must an administrator make when enabling Application Learning in an environment? (Select two.)
Answer(s): A,B
When enabling Application Learning in Symantec Endpoint Protection (SEP), an administrator should consider the following:Increased False Positives: Application Learning may lead to increased false positives, as it identifies unfamiliar or rare applications that might not necessarily pose a threat. Pilot Deployment Recommended: To mitigate potential disruptions, Application Learning should initially be deployed on a small subset of systems. This approach allows administrators to observe its impact, refine policies, and control the learning data gathered before extending it across the entire enterprise.These considerations help manage the resource impact and ensure the accuracy of Application Learning.
What information is required to calculate retention rate?
Answer(s): D
To calculate the retention rate in Symantec Endpoint Security (SES), the following information is required:Number of Endpoints: Determines the total scope of data generation. EAR Data per Endpoint per Day: This is the Endpoint Activity Recorder data size generated daily by each endpoint.Number of Days to Retain: Defines the retention period for data storage, impacting the total data volume.Number of Endpoint Dumps and Dump Size: These parameters contribute to overall storage needs for log data and event tracking.This data allows administrators to accurately project storage requirements and ensure adequate capacity for data retention.
Which two (2) scan range options are available to an administrator for locating unmanaged endpoints? (Select two)
Answer(s): B,C
For locating unmanaged endpoints, administrators in Symantec Endpoint Protection Manager (SEPM) can use the following scan range options:IP Range within the Network: This option allows scanning of specific IP address ranges to locate devices that may not have SEP installed.Subnet Range: Administrators can scan within specific subnets, providing a focused range to detect unmanaged endpoints in targeted sections of the network. These options enable precise scans, helping administrators efficiently identify and manage unmanaged devices.
An organization has several Symantec Endpoint Protection Management (SEPM) Servers without access to the internet. The SEPM can only run LiveUpdate within a specified "maintenance window" outside of business hours.What content distribution method should the organization utilize?
Answer(s): A
For organizations with Symantec Endpoint Protection Manager (SEPM) servers that do not have internet access and require updates only within a specific maintenance window, the JDB file method is an effective solution:Offline Content Distribution: JDB files can be downloaded on an internet-connected device and then manually transferred to SEPM, allowing it to update content offline. Flexible Timing: Since JDB files can be applied during the maintenance window, this method adheres to time restrictions, avoiding disruption during business hours. Using JDB files ensures that SEPM remains updated in environments with limited connectivity or strict operational schedules.
What protection technologies should an administrator enable to protect against Ransomware attacks?
Answer(s): B
To effectively protect against Ransomware attacks, an administrator should enable the following Symantec Endpoint Protection (SEP) technologies:IPS (Intrusion Prevention System): IPS detects and blocks network-based ransomware attacks, preventing exploitation attempts before they reach the endpoint. SONAR (Symantec Online Network for Advanced Response): SONAR provides real-time behavioral analysis, identifying suspicious activity characteristic of ransomware, such as unauthorized file modifications.Download Insight: This technology helps prevent ransomware by evaluating the reputation of files downloaded from the internet, blocking those with a high risk of infection. Together, these technologies offer comprehensive protection against ransomware by covering network, behavior, and download-based threat vectors.
Post your Comments and Discuss Broadcom 250-580 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 250-580 content, but please register or login to continue.