250-441 Administration of Symantec Advanced Threat Protection 3.0 Questions and Answers

SONAR

Insight

System Lockdown

Antivirus

Email Security.cloud

Web security.cloud

Skeptic

Symantec Messaging Gateway

Loyphish

Aurora

ZeroAccess

Michelangelo

SEP and Symantec Messaging Gateway

SEP, Symantec Email Security.cloud, and Security Information and Event Management (SIEM)

SEP and Symantec Email Security.cloud

SEP, Symantec Messaging Gateway, and Symantec Email Security.cloud

Intrusion Prevention

Firewall

SONAR

Application and Device Control

Affected Endpoints

Dashboard

Incident Graph

Events View

Actions Bar

This is a polymorphic threat

This is a DDoS attack

The file has multiple hashes

The file is trying to phone home

System Lockdown

Intrusion Prevention System

Firewall

SONAR

Create a unique Symantec Endpoint Protection Manager (SEPM) domain for ATP

Create an ATP manager for each Symantec Endpoint Protection Manager (SEPM) domain

Create a Symantec Endpoint Protection Manager (SEPM) controller connection for each domain

Create a Symantec Endpoint Protection Manager (SEPM) controller connection for the primary domain

To determine the best plan of action for cleaning up the infection

To isolate infected computers on the network and remediate the threat

To gather threat artifacts and review the malicious code in a sandbox environment

To access the current security plan, adjust where needed, and provide reference materials in the event of a similar incident

ATP will continue to block previously blacklisted addresses but NOT new ones.

ATP does NOT block access to blacklisted addresses unless block mode is enabled.

ATP will clear the existing blacklists.

ATP does NOT block access to blacklisted addresses unless TAP mode is enabled.