Important Broadcom 250-580 Exam Questions

Answer: C

Explanation:

SONAR (Symantec Online Network for Advanced Response) utilizes Symantec Insight to help reduce false positives in malware detection. Symantec Insight provides a reputation-based system that evaluates the trustworthiness of files based on data gathered from millions of endpoints worldwide.

How Symantec Insight Reduces False Positives:

Insight assigns reputation scores to files, which helps SONAR determine whether a file is likely benign or potentially malicious. Files with high reputation scores are less likely to be flagged as threats.

This reputation-based analysis allows SONAR to avoid marking trusted files (e.g., common, widely-used applications) as malicious, thus reducing the rate of false positives.

Advantages Over Other Options:

While virus and spyware definitions (Option A) provide detection signatures, they are static and do not offer the real-time, behavior-based analysis that Insight provides.

The File Fingerprint list (Option B) and Extended File Attributes (EFA) table (Option D) are not used by SONAR specifically for false-positive reduction.

Answer: C

Explanation:

In a Symantec Endpoint Detection and Response (SEDR) database search, an event labeled with operation:1 corresponds to a File Open action. This identifier is part of SEDR's internal operation codes used to log file interactions. When querying or analyzing events in the SEDR database, recognizing this code helps Incident Responders understand that the action recorded was an attempt to access or open a file on the endpoint, which may be relevant in tracking suspicious or malicious activities.

Answer: C

Explanation:

When Symantec Endpoint Protection Manager (SEPM) is enrolled in the Integrated Cyber Defense Manager (ICDm), the Network Intrusion Prevention policy is exclusively managed from the cloud. This setup enables:

Centralized Policy Management: By managing Network Intrusion Prevention in the cloud, ICDm ensures that policy updates and threat intelligence can be applied across all endpoints efficiently.

Real-Time Policy Updates: Cloud-based management allows immediate adjustments to intrusion prevention settings, improving responsiveness to new threats.

Consistent Security Posture: Managing Network Intrusion Prevention from the cloud ensures that all endpoints maintain a unified defense strategy against network-based attacks.

Cloud management of this policy provides flexibility and enhances security across hybrid environments.

Answer: C

Explanation:

To allow the use of a remote administration tool detected as Hacktool.KeyLoggPro without interference from SEP, the administrator should create a Known Risk exception for the tool. This exception type allows specific files or applications to bypass detection, thereby avoiding quarantine or blocking actions.

Steps to Create a Known Risk Exception:

In the SEP management console, navigate to Policies > Exceptions.

Choose to create a Known Risk exception and specify the tool's executable file or file path to prevent SEP from identifying it as a threat.

Why Known Risk Exception is Appropriate:

This type of exception is designed for tools that SEP detects as potentially risky (like hacktools or keyloggers) but are authorized for legitimate use by the organization.

Creating this exception allows the tool to operate without being flagged or quarantined.

Reasons Other Options Are Less Effective:

Tamper Protect exceptions only prevent SEP from being tampered with by other applications.

Application to Monitor exceptions monitor applications without preventing quarantine actions.

SONAR exceptions are specific to behavior-based detections, not risk definitions.

Answer: A

Explanation:

When the Application Exception dialog fails to display applications, it is typically because the 'Learn applications that run on the client computer' setting is disabled. This setting allows SEPM to learn and list the applications running on client systems, enabling administrators to create application-specific exceptions.

Explanation of Application Learning:

Application Learning is a feature that gathers data on applications executed on client systems. When enabled, SEPM records information about these applications in its database, allowing administrators to review and manage exceptions for detected applications.

If this setting is disabled, SEPM will not record or display applications in the Application Exception dialog, making it impossible for administrators to create exceptions based on learned applications.

Steps to Enable Application Learning:

In SEPM, navigate to Clients > Policies > Communications.

Check the box for 'Learn applications that run on the client computers' to enable the feature.

Once enabled, SEPM will start collecting data, and applications will appear in the Application Exception dialog after the clients report back.

Rationale Against Other Options:

Option B (existing exclusions) would not prevent applications from appearing, as these would still be listed for reference.

Option C (installing SEPM on a Domain Controller) and Option D (trusted SEP domain) do not impact application learning visibility in SEPM.