Free Symantec 250-441 Exam Dumps Questions & Answers

An Incident Responder notices traffic going from an endpoint to an IRC channel. The endpoint is listed in an incident. ATP is configured in TAP mode.
What should the Incident Responder do to stop the traffic to the IRC channel?

• A.Isolate the endpoint with an application control policy
• B.Isolate the endpoint with a Quarantine Firewall policy
• C.Blacklist the IRC channel IP
• D.Blacklist the endpoint IP

Which default port does ATP use to communicate with the Symantec Endpoint Protection Manager (SEPM) web services?

• A.8014
• B.1433
• C.8081
• D.8446

What is the second stage of an Advanced Persistent Threat (APT) attack?

• A.Exfiltration
• B.Capture
• C.Discovery
• D.Incursion

Which detection method identifies a file as malware after SEP has queried the file's reputation?

• A.insight
• B.Skeptic
• C.Vantage
• D.Cynic

An ATP Administrator set up ATP: Network in TAP mode and has placed URLs on the blacklist.
What will happen when a user attempts to access one of the blacklisted URLs?

• A.Access to the website is allowed by the network scanner but blocked by ATP: Endpoint and an endpoint event is generated
• B.Access to the website is allowed by the network scanner but a network event is generated
• C.Access to the website is blocked by the network scanner but an event is NOT generated
• D.Access to the website is blocked by the network scanner and a network event is generated