What methods can administrators use to enroll endpoints into SES Complete? (Choose two)

What is the recommended first step when planning a migration of SEPM policies to the ICDm platform within a hybrid deployment?

What component of SES Complete handles blocking of suspicious file execution?

Scenario:
An enterprise security team notices that several users have recently accessed resources they typically do not use. TDAD has raised alerts regarding credential misuse and suspicious lateral movement patterns.
Which two actions should the team take using SES Complete? (Choose two)

Which MITRE ATT&CK framework step includes destroying data and rendering an endpoint inoperable?