An organization is troubleshooting a SONAR false positive and has created an exclusion for the in-house application generating the detection. How can the organization use Process Explorer to verify that the exclusion works?
A) Use Process Explorer to see if secars.dll is still there. If secars.dll is still present in the application as an injected process, ensure the updated policy is applied to the group Use Process Explorer to see if secars.dll is still there. If is still present in the application as an injected process, ensure the updated policy is applied to the group
B) Use Process Explorer to see if UMEngx86.dll is still there. If UMEngx86.dll is still present in the application as an injected process, ensure the updated policy is applied to the group UMEngx86.dll
C) Use Process Explorer to see if IPSFFPI.dll is still there. If IPSFFPI.dll is still present in the application as an injected process, ensure the updated policy is applied to the group IPSFFPI.dll
D) Use Process Explorer to see if sysfer.dll is still there. If sysfer.dll is still present in the application as an injected process, ensure the updated policy is applied to the group sysfer.dll

Question

Quizplus · Accepted Answer

Sysfer.dll is associated with Symantec Endpoint Protection, and its presence as an injected process would indicate that the exclusion policy might not have been applied correctly.

An Organization Is Troubleshooting a SONAR False Positive and Has