Question 1

The security status on the console home page is failing to alert a Symantec Endpoint Protection (SEP) administrator when virus definitions are out of date. How should the SEP administrator enable the Security Status alert?
A) Change the Notifications setting to "Show all notifications"
B) Raise the Security Status thresholds
C) Change the Action Summary display to "By number of computers"
D) Lower the Security Status thresholds

Accepted Answer

Lowering the Security Status thresholds will make the system more sensitive to changes, such as out-of-date virus definitions, thus triggering alerts more readily.

Question 2

Which option is a characteristic of a Symantec Endpoint Protection (SEP) domain?
A) Every administrator from one domain can view data in other domains.
B) Each domain has its own management server and database.
C) Data for each domain is stored in its own separate SEP database.
D) Domains share the same management server and database.

Accepted Answer

Domains in Symantec Endpoint Protection share the same management server and database, allowing centralized management while maintaining separate policies and settings for each domain.

Question 3

Which action can an administrator take to improve the Symantec Endpoint Protection Manager (SEPM) dashboard performance and report accuracy?
A) Rebuilding database indexes
B) Lowering the client installation log entries
C) Limiting the number of backups to keep
D) Decreasing the number of content revisions to keep

Accepted Answer

Rebuilding database indexes can improve performance by optimizing how data is retrieved and managed, thus enhancing dashboard performance and report accuracy.

Question 4

An administrator is troubleshooting a Symantec Endpoint Protection (SEP) replication. Which component log should the administrator check to determine whether the communication between the two sites is working correctly?
A) Tomcat
B) Apache Web Server
C) Group Update Provider (GUP)
D) SQL Server

Accepted Answer

The Tomcat log should be checked because it handles the communication between the Symantec Endpoint Protection Manager (SEPM) sites during replication.

Question 5

A Symantec Endpoint Protection Manager (SEPM) administrator notices performance issues with the SEPM server. The Client tab becomes unresponsive in the SEPM console and .DAT files accumulate in the "agentinfo" folder. Which tool should the administrator use to gather log files to submit to Symantec Technical Support?
A) collectLog.cmd
B) LogExport.exe
C) smc.exe
D) ExportLog.vbs

Accepted Answer

The "collectLog.cmd" tool is used to gather log files from the Symantec Endpoint Protection Manager for troubleshooting and submission to Symantec Technical Support.

Question 6

Which two criteria should an administrator use when defining Location Awareness for the Symantec Endpoint Protection (SEP) client? (Select two.)
A) SEP domain
B) WINS server
C) Network Speed
D) NIC description
E) geographic location

Accepted Answer

The answer of Which two criteria should an administrator use...

Question 7

An administrator is using the SylinkDrop tool to update a Symantec Endpoint Protection client install on a system. The client fails to migrate to the new Symantec Endpoint Protection Manager (SEPM), which is defined correctly in the Sylink.xml file that was exported from the SEPM. Which settings must be provided with SylinkDrop to ensure the successful migration to a new Symantec Endpoint Protection environment with additional Group Level Security Settings?
A) -s "silent"
B) -t "Tamper Protect"
C) -p "password"
D) -r "reboot"

Accepted Answer

The -p "password" option is necessary to provide the password for the Group Level Security Settings, ensuring the client can successfully migrate to the new SEPM environment.

Question 8

An administrator needs to add an Application Exception. When the administrator accesses the Application Exception dialog window, applications fail to appear. What is the likely problem?
A) The Symantec Endpoint Protection Manager is installed on a Domain Controller
B) The client computers already have exclusions for the applications.
C) The Learn applications that run on the client computers setting is disabled.
D) The clients are in a trusted Symantec Endpoint Protection domain.

Accepted Answer

The Learn applications that run on the client computers setting must be enabled for applications to appear in the Application Exception dialog window.

Question 9

A company receives a high number of reports from users that files being downloaded from internal web servers are blocked. The Symantec Endpoint Protection administrator verifies that the Automatically trust any file downloaded from an intranet website option is enabled. Which configuration can cause Insight to block the files being downloaded from the internal web servers?
A) Virus and Spyware definitions are out of date.
B) Local intranet zone is configured incorrectly on the Mac clients browser settings.
C) Intrusion prevention is disabled.
D) Local intranet zone is configured incorrectly on the Windows clients browser settings.

Accepted Answer

The incorrect configuration of the local intranet zone on Windows clients' browser settings can cause Insight to misidentify internal web servers as external, leading to files being blocked.

Question 10

Which two considerations must an administrator make when enabling Application Learning in an environment? (Select two.)
A) Application Learning should be deployed on a small group of systems in the enterprise.
B) Application Learning can generate significant CPU or memory use on a Symantec Endpoint Protection Manager.
C) Application Learning is dependent on Insight.
D) Application Learning requires a file fingerprint list to be created in advance.
E) Application Learning can generate increased false positives.

Accepted Answer

The answer of Which two considerations must an administrator make...

Question 11

An administrator notices that some entries list that the Risk was partially removed. The administrator needs to determine whether additional steps are necessary to remediate the threat. Where in the Symantec Endpoint Protection Manager console can the administrator find additional information on the risk?
A) Infected and At Risk Computers report
B) Risk log
C) Notifications
D) Computer Status report

Accepted Answer

The Risk log in the Symantec Endpoint Protection Manager console provides detailed information about risks, including those that were only partially removed, allowing the administrator to determine if further action is needed.

Question 12

What does SONAR use to reduce false positives?
A) Virus and Spyware definitions
B) Extended File Attributes (EFA) table
C) File Fingerprint list
D) Symantec Insight

Accepted Answer

SONAR uses Symantec Insight to reduce false positives by leveraging reputation-based security to determine the likelihood of a file being malicious.

Question 13

Which two settings does an administrator enable to use the Risk Tracer Feature in the Virus and Spyware Protection policy? (Select two.)
A) Firewall Policy
B) Application and Device Control Policy
C) Application Learning
D) Tamper Protection
E) IPS active response

Accepted Answer

The answer of Which two settings does an administrator enable...

Question 14

An administrator is reviewing an Infected Clients Report and notices that a client repeatedly shows the same malware detection. Although the client remediates the files, the infection continues to display in the logs. Which two functions should be enabled to automate enhanced remediation of a detected threat and its related side effects? (Select two.)
A) Stop Service Automatically
B) Stop and Reload AutoProtect
C) Terminate Processes Automatically
D) Risk Tracer
E) Early Launch Anti-Malware Driver

Accepted Answer

Stop Service Automatically and Terminate Processes Automatically are both functions that can be enabled to automate enhanced remediation of a detected threat and its related side effects.

Question 15

An administrator reports that the Home, Monitors, and Report pages are absent in the Symantec Endpoint Protection Management console when the administrator logs on. Which action should the administrator perform to correct the problem?
A) Grant the Administrator Full Access to Root group of the organization
B) Configure proxy settings for each server in the site
C) Configure External Logging to Enable Transmission of Logs to a Syslog Server
D) Grant View Reports permission to the administrator

Accepted Answer

The answer of An administrator reports that the Home, Monitors,...

Question 16

An administrator changes the Virus and Spyware Protection policy for a specific group that disables Auto-Protect. The administrator assigns the policy and the client systems apply the corresponding policy serial number. Upon visual inspection of a physical client system, the policy serial number is correct. However, Auto-Protect is still enabled on the client system. Which action should the administrator take to ensure that the desired setting is in place on the client?
A) Restart the client system.
B) Enable the padlock next to the setting in the policy.
C) Run a command on the computer to Update Content
D) Withdraw the Virus and Spyware Protection policy

Accepted Answer

The padlock icon in the policy settings indicates whether a setting is locked or unlocked. Enabling the padlock ensures that the setting is enforced on the client systems.

Question 17

Which task should an administrator perform to troubleshoot operation of the Symantec Endpoint Protection embedded database?
A) Verify the sqlserver.exe service is running on port 1433
B) Verify that dbsrv11.exe is listening on port 2638
C) Check the database transaction logs in X:\Program Files\Microsoft SQL Server
D) Check whether the MSSQLSERVER service is running

Accepted Answer

The Symantec Endpoint Protection embedded database uses dbsrv11.exe, which listens on port 2638.

Question 18

A company deploys Symantec Endpoint Protection (SEP) to50 virtual machines running on a single ESXi host. Which configuration change can the administrator make to minimize sudden IOPS impact on the ESXi server while each SEP endpoint communicates with the Symantec Endpoint Protection Manager?
A) Reduce number of content revisions to keep
B) Increase download randomization window
C) Reduce the heartbeat interval
D) Increase Download Insight sensitivity level

Accepted Answer

Increasing the download randomization window spreads out the time when each SEP endpoint communicates with the manager, reducing the likelihood of simultaneous IOPS spikes on the ESXi server.

Question 19

Which protection engine should an administrator enable in order to drop malicious vulnerability scans against a client system?
A) SONAR
B) Intrusion Prevention
C) Application and Device Control
D) Tamper Protection

Accepted Answer

Intrusion Prevention is designed to detect and block malicious network activity, including vulnerability scans, by analyzing network traffic and identifying suspicious patterns.

Question 20

An administrator is designing a new single site Symantec Endpoint Protection environment. Due to perimeter firewall bandwidth restrictions, the design needs to minimize the amount of traffic from content passing through the firewall. Which source must the administrator avoid using?
A) Group Update Provider (GUP)
B) LiveUpdate Administrator (LUA)
C) Symantec Endpoint Protection Manager
D) Shared Insight Cache (SIC)

Accepted Answer

Using LiveUpdate Administrator (LUA) would increase traffic through the firewall as it downloads updates from the internet, which is what the administrator wants to avoid.

Exam 2: Administration of Symantec Email Security.cloud (v1)

The security status on the console home page is failing to alert a Symantec Endpoint Protection (SEP) administrator when virus definitions are out of date. How should the SEP administrator enable the Security Status alert?

Which option is a characteristic of a Symantec Endpoint Protection (SEP) domain?

Which action can an administrator take to improve the Symantec Endpoint Protection Manager (SEPM) dashboard performance and report accuracy?

An administrator is troubleshooting a Symantec Endpoint Protection (SEP) replication. Which component log should the administrator check to determine whether the communication between the two sites is working correctly?

Which two criteria should an administrator use when defining Location Awareness for the Symantec Endpoint Protection (SEP) client? (Select two.)

An administrator needs to add an Application Exception. When the administrator accesses the Application Exception dialog window, applications fail to appear. What is the likely problem?

Which two considerations must an administrator make when enabling Application Learning in an environment? (Select two.)

What does SONAR use to reduce false positives?

Which two settings does an administrator enable to use the Risk Tracer Feature in the Virus and Spyware Protection policy? (Select two.)

An administrator reports that the Home, Monitors, and Report pages are absent in the Symantec Endpoint Protection Management console when the administrator logs on. Which action should the administrator perform to correct the problem?

Which task should an administrator perform to troubleshoot operation of the Symantec Endpoint Protection embedded database?

A company deploys Symantec Endpoint Protection (SEP) to50 virtual machines running on a single ESXi host. Which configuration change can the administrator make to minimize sudden IOPS impact on the ESXi server while each SEP endpoint communicates with the Symantec Endpoint Protection Manager?

Which protection engine should an administrator enable in order to drop malicious vulnerability scans against a client system?

An administrator is designing a new single site Symantec Endpoint Protection environment. Due to perimeter firewall bandwidth restrictions, the design needs to minimize the amount of traffic from content passing through the firewall. Which source must the administrator avoid using?