How would an administrator specify which remote consoles and servers have access to the management server?
Answer(s): A
To control which remote consoles and servers have access to the Symantec Endpoint Protection Management (SEPM) server, an administrator should edit the Server Properties and adjust the Server Communication Permission under the General tab. This setting specifies which remote systems are authorized to communicate with the management server, enhancing security by limiting access to trusted consoles and servers only. Adjusting the Server Communication Permission helps manage server access centrally and ensures only approved systems interact with the management server.
Which designation should an administrator assign to the computer configured to find unmanaged devices?
Answer(s): C
In Symantec Endpoint Protection, the Discovery Agent designation is assigned to a computer responsible for identifying unmanaged devices within a network. This role is crucial for discovering endpoints that lack protection or are unmanaged, allowing the administrator to deploy agents or take appropriate action. Configuring a Discovery Agent facilitates continuous monitoring and helps ensure that all devices on the network are recognized and managed.
An administrator notices that some entries list that the Risk was partially removed. The administrator needs to determine whether additional steps are necessary to remediate the threat. Where in the Symantec Endpoint Protection Manager console can the administrator find additional information on the risk?
To gather more details about threats that were only partially removed, an administrator should consult the Risk log in the Symantec Endpoint Protection Manager (SEPM) console. The Risk log provides comprehensive information about detected threats, their removal status, and any remediation actions taken. By examining these logs, the administrator can determine if additional steps are required to fully mitigate the threat, ensuring that the endpoint is entirely secure and free of residual risks.
Which Endpoint Setting should an administrator utilize to locate unmanaged endpoints on a network subnet?
To locate unmanaged endpoints within a specific network subnet, an administrator should utilize the Discover and Deploy setting. This feature scans the network for endpoints without security management, enabling administrators to identify and initiate the deployment of Symantec EndpointProtection agents on unmanaged devices. This proactive approach ensures comprehensive coverage across the network, allowing for efficient detection and management of all endpoints within the organization.
Why is it important for an Incident Responder to copy malicious files to the SEDR file store or create an image of the infected system during the Recovery phase?
Answer(s): D
During the Recovery phase of an incident response, it is critical for an Incident Responder to copy malicious files to the SEDR file store or create an image of the infected system. This action preserves evidence associated with the incident, allowing for thorough investigation and analysis. By securing a copy of the malicious files or system state, responders maintain a record of the incident that can be analyzed for root cause assessment, used for potential legal proceedings, or retained for post- incident review. Documenting and preserving evidence ensures that key information is available for future reference or audits.
Post your Comments and Discuss Broadcom 250-580 exam prep with other Community members: