Symantec 250-441 - Administration of Symantec Advanced Threat Protection 3.0
In which scenario would it be beneficial for an organization to eradicate a threat from the environment by deleting it?
ATP detects a threat phoning home to a command and control server and creates a new incident. The treat is NOT being detected by SEP, but the Incident Response team conducted an indicators of compromise (IOC) search for the machines that are contacting the malicious sites to gather more information.
Which step should the Incident Response team incorporate into their plan of action?
What is the minimum amount of RAM required for a virtual deployment of the ATP Manager in a production environment?
What is the role of Synapse within the Advanced Threat Protection (ATP) solution?
Which stage of an Advanced Persistent Threat (APT) attack does social engineering occur?
Which two (2 non-Symantec method for restricting traffic are available to the Incident response team?
During a recent virus outlook, an Incident found that the incident Response team was successful in identifying malicious that were communicating with the infected endpoint.
Which two (2) options should be incident Responder select to prevent endpoints from communicating with malicious domains?
An Incident Responder has noticed that for the last month, the same endpoints have been involved with malicious traffic every few days. The network team also identified a large amount of bandwidth being used over P2P protocol.
Which two steps should the Incident Responder take to restrict the endpoints while maintaining normal use of the systems? (Choose two.)
Which policies are required for the quarantine feature of ATP to work?
Which two actions an Incident Responder take when downloading files from the ATP file store? (Choose two.)
