Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. Broadcom
  5. 250-580

Broadcom 250-580 Exam
Endpoint Security Complete - R2 Technical Specialist (Page 4 )

Updated On: 7-Feb-2026
Page 4 of 31
PDF with 150 Questions

How would an administrator specify which remote consoles and servers have access to the management server?

  1. Edit the Server Properties and under the General tab, change the Server Communication Permission.
  2. Edit the Communication Settings for the Group under the Clients tab.
  3. Edit the External Communication Settings for the Group under the Clients tab.
  4. Edit the Site Properties and under the General tab, change the server priority.

Answer(s): A

Explanation:

To control which remote consoles and servers have access to the Symantec Endpoint Protection Management (SEPM) server, an administrator should edit the Server Properties and adjust the Server Communication Permission under the General tab. This setting specifies which remote systems are authorized to communicate with the management server, enhancing security by limiting access to trusted consoles and servers only. Adjusting the Server Communication Permission helps manage server access centrally and ensures only approved systems interact with the management server.



Which designation should an administrator assign to the computer configured to find unmanaged devices?

  1. Discovery Device
  2. Discovery Manager
  3. Discovery Agent
  4. Discovery Broker

Answer(s): C

Explanation:

In Symantec Endpoint Protection, the Discovery Agent designation is assigned to a computer responsible for identifying unmanaged devices within a network. This role is crucial for discovering endpoints that lack protection or are unmanaged, allowing the administrator to deploy agents or take appropriate action. Configuring a Discovery Agent facilitates continuous monitoring and helps ensure that all devices on the network are recognized and managed.



An administrator notices that some entries list that the Risk was partially removed. The administrator needs to determine whether additional steps are necessary to remediate the threat.
Where in the Symantec Endpoint Protection Manager console can the administrator find additional information on the risk?

  1. Risk log
  2. Computer Status report
  3. Notifications
  4. Infected and At-Risk Computers report

Answer(s): A

Explanation:

To gather more details about threats that were only partially removed, an administrator should consult the Risk log in the Symantec Endpoint Protection Manager (SEPM) console. The Risk log provides comprehensive information about detected threats, their removal status, and any remediation actions taken. By examining these logs, the administrator can determine if additional steps are required to fully mitigate the threat, ensuring that the endpoint is entirely secure and free of residual risks.



Which Endpoint Setting should an administrator utilize to locate unmanaged endpoints on a network subnet?

  1. Device Discovery
  2. Endpoint Enrollment
  3. Discover and Deploy
  4. Discover Endpoints

Answer(s): C

Explanation:

To locate unmanaged endpoints within a specific network subnet, an administrator should utilize the Discover and Deploy setting. This feature scans the network for endpoints without security management, enabling administrators to identify and initiate the deployment of Symantec Endpoint

Protection agents on unmanaged devices. This proactive approach ensures comprehensive coverage across the network, allowing for efficient detection and management of all endpoints within the organization.



Why is it important for an Incident Responder to copy malicious files to the SEDR file store or create an image of the infected system during the Recovery phase?

  1. To create custom IPS signatures
  2. To test the effectiveness of the current assigned policy settings in the Symantec Endpoint Protection Manager (SEPM)
  3. To have a copy of the file for policy enforcement
  4. To document and preserve any pieces of evidence associated with the incident

Answer(s): D

Explanation:

During the Recovery phase of an incident response, it is critical for an Incident Responder to copy malicious files to the SEDR file store or create an image of the infected system. This action preserves evidence associated with the incident, allowing for thorough investigation and analysis. By securing a copy of the malicious files or system state, responders maintain a record of the incident that can be analyzed for root cause assessment, used for potential legal proceedings, or retained for post- incident review. Documenting and preserving evidence ensures that key information is available for future reference or audits.






Post your Comments and Discuss Broadcom 250-580 exam prep with other Community members:

Join the 250-580 Discussion