Symantec 250-580 - Endpoint Security Complete - R2 Technical Specialist

In antimalware solutions,Level 5intensity is defined as a setting where the software blocks files that are considered either most certainly malicious or potentially malicious. This level aims to balance security with usability by erring on the side of caution; however, it acknowledges that some level of bothfalsepositives(legitimate files mistakenly flagged as threats) andfalse negatives(malicious files mistakenly deemed safe) may still occur.

This level is typically used in environments where security tolerance is high but with an understanding that some legitimate files might occasionally be flagged. It provides robust protection without the extreme strictness of the highest levels, thus reducing, but not eliminating, the possibility of false alerts while maintaining an aggressive security posture.

TheThreat Defense for Active Directory (AD) Deceptive Accountfeature serves as a honeypot within Active Directory, designed to lure attackers who are attempting to map out AD for valuable accounts or resources. By using deceptive accounts, this feature can expose attackers’ reconnaissance activities, such as attempts to gather credential information or access sensitive accounts. This strategy helps detect attackers early by observing interactions with fake accounts set up to appear as attractive targets.

When anIncident Responderdetermines that an endpoint is compromised, the first action to contain the threat is to use theIsolationfeature in Symantec Endpoint Detection and Response (SEDR). Isolation effectively disconnects the affected endpoint from the network, thereby preventing the malicious threat from communicating with other systems or spreading within the network environment. This feature enables the responder to contain the threat swiftly, allowing further investigation and remediation steps to be conducted without risk of lateral movement by the attacker.

To gather more details about threats that were onlypartially removed, an administrator should consult theRisk login the Symantec Endpoint Protection Manager (SEPM) console. The Risk log provides comprehensive information about detected threats, their removal status, and any remediation actions taken. By examining these logs, the administrator can determine if additional steps are required to fully mitigate the threat, ensuring that the endpoint is entirely secure and free of residual risks.

To allow the use of aremote administration tool detected as Hacktool.KeyLoggProwithout interference from SEP, the administrator should create aKnown Risk exceptionfor the tool. This exception type allows specific files or applications to bypass detection, thereby avoiding quarantine or blocking actions.

Steps to Create a Known Risk Exception:

In the SEP management console, navigate toPolicies > Exceptions.

Choose to create aKnown Risk exceptionand specify the tool’s executable file or file path to prevent SEP from identifying it as a threat.

Why Known Risk Exception is Appropriate:

This type of exception is designed for tools that SEP detects as potentially risky (like hacktools or keyloggers) but are authorized for legitimate use by the organization.

Creating this exception allows the tool to operate without being flagged or quarantined.

Reasons Other Options Are Less Effective:

Tamper Protect exceptionsonly prevent SEP from being tampered with by other applications.

Application to Monitor exceptionsmonitor applications without preventing quarantine actions.

SONAR exceptionsare specific to behavior-based detections, not risk definitions.

References: Creating Known Risk exceptions is the recommended approach when allowing specific tools in SEP that may otherwise be detected as threats​.

Lateral Movementis the type of security threat used by attackers toexploit vulnerable applicationsand move across systems within a network. This technique allows attackers to gain access to multiple systems by exploiting vulnerabilities in applications, thereby advancing deeper into the network.

Understanding Lateral Movement:

Lateral movement involves exploiting software vulnerabilities to access additional systems and data resources.

Attackers use this method to spread their influence within a compromised network, often leveraging application vulnerabilities to pivot to other systems.

Why Other Options Are Incorrect:

Privilege Escalation(Option B) focuses on gaining higher access rights on a single system.

Credential Access(Option C) involves stealing login credentials rather than exploiting applications.

Command and Control(Option D) refers to the communication between compromised devices and an attacker’s server, not the exploitation of applications.

References: Lateral movement leverages application vulnerabilities to expand attacker access within an organization’s network, making it a common threat vector in targeted attacks​.

Administrators can use theApplication Catalogin Symantec Endpoint Security to create custom behavioral isolation policies. This tool compiles data on application behavior, enabling administrators to define isolation policies that address specific behaviors observed within their environment. By leveraging the Application Catalog, administrators can tailor policies based on the behaviors of applications, enhancing the control and containment of potentially malicious activity.

Threat Defense for Active Directory(TDAD) provides protection primarily at theAttack Surface Reductionstage in the Attack Chain. TDAD focuses on minimizing the exposure of Active Directory by deploying deceptive measures, such as honeypots and decoy objects, which limit the opportunities forattackers to exploit AD vulnerabilities or gather useful information. By reducing the visible attack surface, TDAD makes it more difficult for attackers to successfully initiate or escalate attacks within the AD environment.

Function of Attack Surface Reduction:

Attack Surface Reduction involves implementing controls and deceptive elements that obscure or complicate access paths for potential attackers.

TDAD’s deception techniques and controls help divert and confuse attackers, preventing them from finding or exploiting AD-related assets.

Why Other Options Are Incorrect:

Attack Prevention(Option B) andDetection and Response(Option C) occur later in the chain, focusing on mitigating and reacting to detected threats.

Breach Prevention(Option D) encompasses a broader strategy and does not specifically address TDAD’s role in reducing AD exposure.

References: TDAD’s role in reducing the attack surface for Active Directory supports preemptive measures against potential threats in the early stages of the attack chain​.

Threat Defense for Active Directory (TDAD) employsHoneypot Trapsas a primary prevention technique to detect and expose attackers. These honeypot traps act as decoys within the network, mimicking legitimate Active Directory (AD) objects or data that would attract attackers aiming to gather AD information or exploit AD weaknesses.

Honeypot Trap Functionality:

Honeypot traps are strategically placed to appear as appealing targets, such as privileged accounts or critical directories, without being part of the actual AD infrastructure.

When attackers interact with these traps, TDAD records their actions, which can then trigger alerts, allowing administrators to identify and monitor suspicious activities.

Exposure and Mitigation:

By enticing attackers to interact with fake assets, honeypot traps help expose malicious intentions and techniques. This information can be used for forensic analysis and to enhance future defenses.

This technique allows organizations to expose potential threats proactively, before any real AD resources are compromised.

References: This approach is part of Symantec’s Active Directory security strategies and utilizes honeypot mechanisms to deter and identify intruders in real-time​.

To prevent ransomware variants, such as Cryptolocker, from executing withdouble executable file names, an administrator should enableSONAR (Symantec Online Network for Advanced Response). SONAR detects and blocks suspicious behaviors based on file characteristics and real-time monitoring,which is effective in identifying malicious patterns associated with ransomware. By analyzing unusual behaviors, such as double executable file names, SONAR provides proactive protection against ransomware threats before they can cause harm to the system.