Symantec 250-580 Dumps Questions Answers

Calculating storage requirements for Symantec Endpoint Security (SES) involves gathering specific information related to data retention and event storage needs. The required information includes:

Number of Endpoints:Determines the scale of data to be managed.

EAR Data per Endpoint per Day:Refers to the Endpoint Activity Recorder (EAR) data generated by each endpoint daily, affecting storage usage.

Number of Days to Retain:Indicates the data retention period, which impacts the total volume of stored data.

Number of Endpoint Dumps and Dump Size:These parameters define the size and number of memory dumps, which are essential for forensic analysis and troubleshooting.

This information allows accurate calculation of storage needs, ensuring adequate capacity for logs, dumps, and activity data.

During theRecovery phaseof an incident response, it is critical for an Incident Responder to copy malicious files to theSEDR file storeor create an image of the infected system. This action preserves evidence associated with the incident, allowing for thorough investigation and analysis. By securing a copy of the malicious files or system state, responders maintain a record of the incident that can be analyzed for root cause assessment, used for potential legal proceedings, or retained for post-incident review. Documenting and preserving evidence ensures that key information is available for future reference or audits.

Symantec Endpoint Detection and Response (EDR) hunts and detects Indicators of Compromise (IoCs) bysearching the EDR database and other data sources directly. This direct search approach allows EDR to identify malicious patterns or artifacts that may signal a compromise.

How EDR Hunts IoCs:

By querying the EDR database along with data from connected sources, administrators can identify signs of potential compromise across the environment. This includes endpoint logs, network traffic, and historical data within the EDR platform.

The platform enables security teams to look for specific IoCs, such as file hashes, IP addresses, or registry modifications associated with known threats.

Why Other Options Are Less Suitable:

Viewing PowerShell processes (Option B) or detecting memory exploits with SEP (Option C) are specific techniques but do not represent the comprehensive IoC-hunting approach.

Detonating suspicious files in sandboxes (Option D) is more of a behavioral analysis method rather than direct IoC hunting.

References: Direct database and data source searches are core to EDR’s hunting capabilities, as outlined in Symantec’s EDR operational guidelines​.