Online Access Free 250-605 Practice Test

What is the primary function of the Endpoint Activity Recorder (EAR) within SEDR?

• A.It checks internet bandwidth for the appliance
• B.It updates SEP signatures in real time
• C.It pushes quarantine definitions to SEP clients
• D.It captures and logs endpoint behavior for forensic analysis

How can an analyst use the Evidence Table during an investigation in SEDR?

• A.To list only infected endpoints
• B.To delete false positives directly from the database
• C.To view event logs generated by the SEPM
• D.To organize and correlate all detected evidence related to a threat

Which prerequisite is essential before installing Symantec Endpoint Detection and Response (SEDR)?

• A.An SEPM server must be already deployed and integrated
• B.Domain Group Policy Objects must be disabled
• C.The system must have Intel vPro technology
• D.Microsoft SQL Server must be installed

Which two configurations must be in place for SEDR to accurately detect and classify threats?
(Choose two)

• A.SEPM must be running in high-availability mode
• B.SEDR Management Console must be running on HTTPS
• C.SEP clients must have telemetry and logging enabled
• D.Endpoint Activity Recorder must be configured and active

What is the primary difference between Centralized Exceptions and Administrator-defined scans in SEP?

• A.Administrator-defined scans can bypass SONAR protection
• B.Centralized Exceptions only apply during scheduled scans
• C.Centralized Exceptions apply globally across policies, while scan exclusions apply only during defined scans
• D.Administrator-defined scans enforce custom rules on unmanaged clients