250-561 Online Practice Questions and Answers

Which URL is responsible for notifying the SES agent that a policy change occurred in the cloud console?

A. spoc.norton.com

B. stnd-ipsg.crsi-symantec.com

C. ent-shasta.rrs-symantec.com

D. ocsp.digicert.com

Which SES security control protects against threats that may occur in the Impact phase?

A. Device Control

B. IPS

C. Antimalware

D. Firewall

Which alert rule category includes events that are generated about the cloud console?

A. Security

B. Diagnostic

C. System

D. Application Activity

Files are blocked by hash in the blacklist policy.

Which algorithm is supported, in addition to MD5?

A. SHA256

B. SHA256 "salted"

C. MD5 "Salted"

D. SHA2

An endpoint is offline, and the administrator issues a scan command. What happens to the endpoint when it restarts, if it lacks connectivity?

A. The system is scanning when started.

B. The system downloads the content without scanning.

C. The system starts without scanning.

D. The system scans after the content update is downloaded.

Which two (2) options is an administrator able to use to prevent a file from being fasely detected? (Select two)

A. Assign the file a SHA-256 cryptographic hash

B. Add the file to a Whitelist policy

C. Reduce the Intensive Protection setting of the Antimalware policy

D. Register the file with Symantec's False Positive database

E. Rename the file

An administrator needs to create a new Report Template that will be used to track firewall activity. Which two (2) report template settings are optional? (Select 2)

A. Output format

B. Generation schedule

C. Email recipients

D. Time frame

E. Size restrictions

Which SES feature helps administrator apply policies based on specific endpoint profiles?

A. Device Groups

B. Device Profiles

C. Policy Bundles

D. Policy Groups

The ICDm has generated a blacklist task due to malicious traffic detection. Which SES component was utilized to make that detection?

A. Antimalware

B. Reputation

C. Firewall

D. IPS

An endpoint fails to retrieve content updates.

Which URL should an administrator test in a browser to determine if the issue is network related?

A. https://liveupdate.symantec,com/livetri.zi

B. http://update.symantec.com/livetri.zip

C. https://spocsymantec.com/livetri.zip

D. https://update.symantec.com/livetri.zip