250-561 Online Practice Questions and Answers

How long does a blacklist task remain in the My Tasks view after its automatic creation?

A. 180 Days

B. 30 Days

C. 60 Days

D. 90 Days

Which SEPM-generated element is required for an administrator to complete the enrollment of SEPM to the cloud console?

A. Token

B. SEPM password

C. Certificate key pair

D. SQL password

Which two (2) steps should an administrator take to guard against re-occurring threats? (Select two)

A. Confirm that daily active and weekly full scans take place on all endpoints

B. Verify that all endpoints receive scheduled Live-Update content

C. Use Power Eraser to clean endpoint Windows registries

D. Add endpoints to a high security group and assign a restrictive Antimalware policy to the group

E. Quarantine affected endpoints

Which device page should an administrator view to track the progress of an issued device command?

A. Command Status

B. Command History

C. Recent Activity

D. Activity Update

In which phase of MITRE framework would attackers exploit faults in software to directly tamper with system memory?

A. Exfiltration

B. Discovery

C. Execution

D. Defense Evasion

Which option should an administrator utilize to temporarily or permanently block a file?

A. Delete

B. Hide

C. Encrypt

D. Blacklist

Which policy should an administrator edit to utilize the Symantec LiveUpdate server for pre- release content?

A. The Firewall Policy

B. The System Schedule Policy

C. The System Policy

D. The LiveUpdate Policy

An administrator suspects that several computers have become part of a botnet. What should the administrator do to detect botnet activity on the network?

A. Enable the Command and Control Server Firewall

B. Add botnet related signatures to the IPS policy's Audit Signatures list

C. Enable the IPS policy's Show notification on the device setting

D. Set the Antimalware policy's Monitoring Level to 4

Which report template type should an administrator utilize to create a daily summary of network threats detected?

A. Network Risk Report

B. Blocked Threats Report

C. Intrusion Prevention Report

D. Access Violation Report

Which IPS Signature type is Primarily used to identify specific unwanted traffic?

A. Attack

B. Probe

C. Audit

D. Malcode