Free 250-586 sample questions

Correct answer: Configure both SEPMs as replication partners, replicating only logs and policies, but not client packages or definitions.

For high availability and reduced WAN traffic, the best practice is to configure the SEPMs as replication partners for logs and policies only. Client packages and definitions are large and should be downloaded from the central LiveUpdate source to each SEPM independently, and then distributed to clients via GUPs. Replicating packages would consume significant bandwidth between the SEPMs without adding value in this GUP-based design.

Correct answers: Application Hardening using System Lockdown; Network Intrusion Prevention System (IPS)

System Lockdown (Application Hardening) is ideal for fixed-function devices like medical equipment. It can create a whitelist of known good applications and block any unauthorized executables from running, effectively preventing malware execution on the unsupported OS.

Since the OS cannot be patched, it is vulnerable to network-based exploits. The Network IPS can block known attack signatures at the network layer, providing a critical compensating control to protect the vulnerable OS from being compromised.

Correct answer: A network firewall is blocking the specific TCP port used for client-server communication.

The ability to ping the server confirms basic network connectivity (ICMP), but it does not guarantee that the application-level communication ports (e.g., TCP 8014 or 443) are open. A firewall rule blocking these specific ports for traffic from the remote office's subnet is the most common and logical cause for this type of isolated communication failure.

Correct answer: True

This statement is true. System Lockdown has two modes: whitelist and blacklist. In blacklist mode, it functions as a traditional application blocking tool, preventing only the specified applications (by file hash or path) from executing, while permitting all others.

Correct answer: Create a parent group with the baseline policy, and a child group for the computer science department that inherits the policy but has a non-shared, overriding Application and Device Control policy.

This is the correct and most efficient design. By creating a child group that inherits from the parent, all baseline settings are automatically applied. Creating a specific, non-shared policy for a single feature (like Application and Device Control) for the child group allows administrators to override just that part of the policy while inheriting all other settings, avoiding policy duplication and simplifying management.

Correct answer: Export a managed client installation package from the SEPM, specifically created for the 'New Deployments' group, and include it in the base workstation image or deploy via a script.

This is the most efficient and scalable method. Exporting a managed package embeds the communication settings (Sylink.xml) and the target group information directly into the installer. This package can then be easily scripted or included in an imaging process for automated, large-scale deployment, ensuring all clients report to the correct group automatically.

Correct answer: To provide a cloud-based console that unifies visibility and management across multiple Symantec security products and bridges on-premises SEPM domains to the cloud.

The core purpose of ICDm is to act as a cloud-based bridge. It enrolls on-premises SEPM domains, allowing administrators to manage both their on-premises and cloud-native endpoints from a single, unified console, and integrates data from other Symantec products like Email Security.cloud.

Correct answer: The file was encrypted before being copied, preventing the DLP agent from scanning its content.

Endpoint DLP policies work by scanning file content for defined patterns (like credit card numbers). If a file is placed inside an encrypted container (e.g., a password-protected ZIP file) or is otherwise encrypted before the copy operation, the agent cannot inspect the content. The DLP engine sees an encrypted blob of data, not the sensitive content within, and therefore does not trigger the blocking rule. This is a common method for bypassing content-aware DLP.

Correct answer: Create separate SEPM groups for POS and Distribution Centers. For these groups, configure a policy that uses System Lockdown in whitelist mode and create detailed file/folder exceptions for the logistics applications. Use a standard policy with all protection engines for corporate users.

This is the optimal solution. System Lockdown in whitelist mode is perfect for fixed-function systems like POS terminals, as it provides maximum security with minimal performance overhead by only allowing known good applications to run. For the distribution centers, creating specific, targeted exceptions for the known-good logistics applications prevents false positives without broadly weakening security. This layered approach correctly addresses the specific needs of each environment.

Correct answer: Creating multiple LiveUpdate policies, one for each site, and assigning them to site-specific SEPM groups.

This is the most effective method for strict control. By creating separate SEPM groups for each physical site and assigning a unique LiveUpdate policy that lists only the local GUP(s) for that site, you ensure that clients can only use their designated GUP. This prevents clients from one site from traversing the WAN to get updates from a GUP at another site, thereby controlling traffic and GUP load.