250-441 Administration of Symantec Advanced Threat Protection 3.0 Questions and Answers

Email Protect (antivirus and anti-spam)

Email Safeguard (antivirus, anti-spam, encryption, data protection and image control)

Symantec Messaging Gateway

Skeptic

Create a unique Cynic account to provide to ATP

Create a unique Symantec Messaging Gateway account to provide to ATP

Create a unique Symantec Protection Manager (SEPM) administrator account to provide to ATP

Create a unique Email Security.cloud portal account to provide to ATP

To have less raw data to analyze

To evaluate the data, including information from other systems

To access expanded historical data

To determine what policy settings to modify in the Symantec Endpoint Protection Manager (SEPM)

To determine the best cleanup method

Skeptic

Vantage

insight

Cynic

Close any open shares

Identify the threat and understand how it spreads

Create subnets or VLANs and configure the network devices to restrict traffic

Set executables on network drives as read only

Identify affected clients

The endpoint automatically switches to using a Compliance location, where a Compliance policy is applied to the computer.

The endpoint automatically switches to using a System Lockdown location, where a System Lockdown

policy is applied to the computer.

The endpoint automatically switches to using a Host Integrity location, where a Host Integrity policy is

applied to the computer.

The endpoint automatically switches to using a Quarantine location, where a Quarantine policy is applied to the computer.

The Incident Response team is identifying the scope of the infection and is gathering a list of infected systems.

The Incident Response team is reviewing detections in the risk logs and assigning a High-Security Antivirus and Antispyware policy in the Symantec Endpoint Protection Manager (SEPM).

The Incident Response team completed their analysis of the threat and added it to a blacklist.

The Incident Response team is analyzing the file to determine if it is a threat or a false positive.

Isolate a computer while it is manually being remediated

Submit files to a Central Quarantine server

Filter all traffic leaving the network

Intercept all traffic entering the network

To determine the best plan of action for cleaning up the infection

To isolate infected computers on the network and remediate the threat

To gather threat artifacts and review the malicious code in a sandbox environment

To access the current security plan, adjust where needed, and provide reference materials in the event of a similar incident

Use the isolate command in ATP to move all endpoints to a quarantine network.

Blacklist suspicious domains in the ATP manager.

Deploy a High-Security Antivirus and Antispyware policy in the Symantec Endpoint Protection Manager (SEPM).

Create a firewall rule in the Symantec Endpoint Protection Manager (SEPM) or perimeter firewall that blocks traffic to the domain.

Run a full system scan on all endpoints.

Configure a SIEM feed from the portal to the ATP environment

Configure email reports on convictions

Submit false positive and false negative files

Query hashes

Submit hashes to Insight