Broadcom Endpoint Security Complete - R2 Technical Specialist 250-580 Exam Questions

Answer : A

Symantec Endpoint Detection and Response (EDR) hunts and detects Indicators of Compromise (IoCs) by searching the EDR database and other data sources directly. This direct search approach allows EDR to identify malicious patterns or artifacts that may signal a compromise.

How EDR Hunts IoCs:

By querying the EDR database along with data from connected sources, administrators can identify signs of potential compromise across the environment. This includes endpoint logs, network traffic, and historical data within the EDR platform.

The platform enables security teams to look for specific IoCs, such as file hashes, IP addresses, or registry modifications associated with known threats.

Why Other Options Are Less Suitable:

Viewing PowerShell processes (Option B) or detecting memory exploits with SEP (Option C) are specific techniques but do not represent the comprehensive IoC-hunting approach.

Detonating suspicious files in sandboxes (Option D) is more of a behavioral analysis method rather than direct IoC hunting.

Answer : D

In Symantec Endpoint Security (SES), Device Groups enable administrators to apply policies based on specific endpoint profiles. Device Groups categorize endpoints according to characteristics like department, location, or device type, allowing tailored policy application that meets the specific security needs of each group. By using Device Groups, administrators can efficiently manage security policies, ensuring relevant protections are applied based on the endpoint's profile.

Answer : D

In Symantec Endpoint Detection and Response (SEDR), the Block List feature allows administrators to manually block a specific file hash identified as malicious. By adding the hash of the malicious file to the Block List, SEDR ensures that the file cannot execute or interact with the network, preventing further harm. This manual blocking capability provides administrators with direct control over specific threats detected in their environment.

Answer : A, C

For an After Actions Report in Symantec EDR, an Incident Responder should gather data from both the Incident Manager and Syslog:

Incident Manager:

This is the primary interface for tracking incidents, where responders can review incident details, timeline, response actions, and associated IoCs. It provides a full view of the case, including actions taken and the threat's impact on the environment.

Syslog:

Syslog captures logs and alerts from various network devices and security systems, providing valuable information on system events related to the incident. Collecting syslog data helps in analyzing broader network impacts and documenting incident response activities.

Why Other Options Are Less Suitable:

Policies (Option B) are not directly relevant to specific incident details.

Action Manager (Option D) tracks response actions but lacks the comprehensive case view provided by Incident Manager.

Endpoint Search (Option E) is a tool for querying endpoint data but is not a centralized reporting source.

Answer : D

The Advanced Machine Learning feature in Symantec Endpoint Security (SES) uses a sophisticated model trained on a large dataset of known good and known bad files to detect malware effectively. Here's how it functions:

Training Model: The model is built from extensive data on benign and malicious files, allowing it to discern patterns that indicate a file's potential harm.

Predictive Malware Detection: Advanced Machine Learning can detect new and evolving malware strains without relying solely on traditional signature-based methods, offering proactive protection.

Real-Time Decision Making: When SES encounters a file, it consults this model to predict whether the file is likely harmful, enabling quick response to potential threats.

This feature strengthens SES's ability to detect malware dynamically, enhancing endpoint security through intelligent analysis of file attributes.

Answer : C

When setting up Active Directory (AD) integration with Symantec Endpoint Protection Manager (SEPM), Symantec's best practice is to import the existing AD structure to manage clients in user mode. This approach offers several benefits:

Simplified Client Management: By importing the AD structure, SEPM can mirror the organizational structure already defined in AD, enabling easier management and assignment of policies to groups or organizational units.

User-Based Policies: Organizing clients in user mode allows policies to follow users across devices, providing consistent protection regardless of where the user logs in.

Streamlined Updates and Permissions: Integration with AD ensures that any changes in user accounts or groups are automatically reflected within SEPM, reducing administrative effort and potential errors in client organization.

This best practice enhances SEPM's functionality by leveraging the established structure in AD.

Answer : C

SONAR (Symantec Online Network for Advanced Response) utilizes Symantec Insight to help reduce false positives in malware detection. Symantec Insight provides a reputation-based system that evaluates the trustworthiness of files based on data gathered from millions of endpoints worldwide.

How Symantec Insight Reduces False Positives:

Insight assigns reputation scores to files, which helps SONAR determine whether a file is likely benign or potentially malicious. Files with high reputation scores are less likely to be flagged as threats.

This reputation-based analysis allows SONAR to avoid marking trusted files (e.g., common, widely-used applications) as malicious, thus reducing the rate of false positives.

Advantages Over Other Options:

While virus and spyware definitions (Option A) provide detection signatures, they are static and do not offer the real-time, behavior-based analysis that Insight provides.

The File Fingerprint list (Option B) and Extended File Attributes (EFA) table (Option D) are not used by SONAR specifically for false-positive reduction.