Free 250-580 sample questions

Correct answer: Create a dedicated, digitally signed certificate for the development team and add it to the Application Control policy's list of trusted publishers.

This is the most secure and scalable solution. Using a trusted publisher certificate allows developers to sign their own compiled code, which Application Control will then trust. This avoids the insecurity of path-based exceptions (where malware could be placed), the potential over-permission of allowing any process from an IDE, and the administrative nightmare of constantly updating file hashes every time the code is recompiled.

Correct answer: Use the Process Lineage view to visualize the entire chain of events and identify all related processes, file modifications, and network connections.

While isolation and memory dumps are valid response actions, the immediate next step for *investigation* is to understand the scope. The Process Lineage view provides a graphical representation of the entire attack chain, from the initial email attachment to the PowerShell execution and any subsequent actions. This is the most efficient way to quickly grasp the full context before deciding on specific remediation or containment actions.

Correct answers: In the SEPM console, navigate to Admin > Servers > Server Properties and enter the proxy IP, port, and credentials.; Use the Windows `netsh winhttp` command-line tool on the SEPM server to set the system-wide proxy.

The Symantec Endpoint Protection Manager itself must be configured to use the proxy for its outbound communications to the cloud console. This is the primary location for setting up this connection.

For certain SEPM services and the enrollment process itself, SEPM relies on the Windows HTTP Services (WinHTTP). Configuring the proxy at this level ensures that all necessary components can reach the cloud services, supplementing the settings within the SEPM console.

Correct answer: Configure one of the servers in the secure segment as a Group Update Provider (GUP) and use a LiveUpdate Administrator (LUA) server to download and publish content to a distribution center that the GUP can access.

This is the standard, supported method for managing air-gapped environments. The LUA server acts as an intermediary, downloading content from Symantec and placing it on an internal web or file share (distribution center). The GUP in the secure segment is then configured to pull from this internal location and distribute the updates to its peers. This is far more scalable and manageable than manual .jdb updates or setting up a full replication partner.

Correct answer: False

False. A Host Integrity failure does not automatically move a client to a different group. Instead, it typically triggers a firewall rule that applies a more restrictive 'Quarantine' firewall policy to the non-compliant client, limiting its network access until it meets the integrity requirements. The client remains in its original management group.

Correct answer: File and folder exceptions in the Antivirus policy apply to file-based scans (Auto-Protect, scheduled scans) but not to SONAR's real-time behavioral analysis.

This is a critical distinction. SONAR monitors process behavior in real-time (API calls, memory access, etc.), not just files at rest. Standard file/folder exceptions are designed for file-based scanning engines. To prevent SONAR from flagging a legitimate application's behavior, a separate SONAR-specific exception (e.g., by application path or hash) must be created in the Exceptions policy.

Correct answer: The client is trying to communicate with the SEPM using the SYSTEM account, but the proxy credentials in the policy are user-specific.

The Symantec agent (sylink) runs under the local SYSTEM account. If the proxy server requires user-based authentication (e.g., domain credentials), the SYSTEM account will not have them, leading to an authentication failure (HTTP 407). The proxy credentials specified in the policy are often user-context specific and not available to the SYSTEM account. The solution is often to use a proxy that allows authentication based on machine account or IP address, or to configure proxy bypass for SEPM traffic.

Correct answer: `process.name:powershell.exe AND process.command_line:*IEX*DownloadString*`

The ICDm threat hunting query language uses a Lucene-like syntax. The correct format specifies the field (`process.name`), a colon, and the value (`powershell.exe`). The `AND` operator links conditions. For the command line, wildcards (`*`) are used to match the contained substrings effectively. The other options use incorrect operators (`=`, `CONTAINS`) or syntax for this specific interface.

Correct answer: Block the 'USB Mass Storage Devices' Class ID and add the specific Device IDs of the encrypted USB drives to the hardware exclusion list.

This is the correct, layered approach. First, you block the entire class of devices you want to control ('USB Mass Storage Devices'), which is more efficient than blocking the generic 'USB' class. Then, you add specific, granular exclusions for the hardware you want to permit. Using the unique Device ID (or Hardware ID) for each company-issued encrypted drive ensures only those specific devices are allowed, fulfilling the security requirement precisely.

Correct answer: It provides a detailed, step-by-step record of the installation and rollback process, including errors encountered.

The `sesinstaller.log` is the primary troubleshooting tool for failed agent installations. It captures each action performed by the installer, from system checks and file copying to registry modifications and service creation. Any errors that cause the installation to fail or roll back will be recorded in this file, making it essential for diagnostics.