250-441 Administration of Symantec Advanced Threat Protection 3.0 Question and Answers

The Incident Response team is identifying the scope of the infection and is gathering a list of infected systems.

The Incident Response team is reviewing detections in the risk logs and assigning a High-Security Antivirus and Antispyware policy in the Symantec Endpoint Protection Manager (SEPM).

The Incident Response team completed their analysis of the threat and added it to a blacklist.

The Incident Response team is analyzing the file to determine if it is a threat or a false positive.

Close any open shares

Identify the threat and understand how it spreads

Create subnets or VLANs and configure the network devices to restrict traffic

Set executables on network drives as read only

Identify affected clients

48 GB

64 GB

16 GB

32GB

ATP: Email

ATP: Endpoint

ATP: Network

ATP: Roaming

It ensures that the Incident is resolved, and the responder can clean up the infection.

It ensures that the Incident is resolved, and the responder can determine the best remediation method.

It ensures that the Incident is resolved, and the threat is NOT continuing to spread to other parts of the

environment.

It ensures that the Incident is resolved, and the responder can close out the incident in the ATP manager.

The search runs and returns results in ATP and then displays them in SEPM.

This is only an endpoint search.

This is a database search; a command is NOT sent to SEPM for this type of search.

The browser cached result from a previous search with the same criteria.

Use the isolation command in ATP to move endpoint to quarantine network.

Blacklist suspicious domain in the ATP manager.

Deploy a high-Security antivirus and Antispyware policy in the Symantec Endpoint protection Manager (SEPM.)

Create a firewall rule in the Symantec Endpoints Protection Manager (SEPM) or perimeter firewall that blocks

traffic to the domain.

Run a full system scan on all endpoints

Add to Whitelist

Run an indicators of compromise (IOC) search

Submit to VirusTotal

Submit to Cynic

To perform a SQL injection on an internal server

To extract sensitive information from the target

To perform network discovery on the target

To deliver malicious code that breaches the target

Analyze suspicious code with Cynic

Email the files to Symantec Technical Support

Double-click to open the files

Diagnose the files as a threat based on the file names

Submit the files to Security Response