An Incident Responder launches a search from ATP for a file hash. The search returns the results
immediately. The responder reviews the Symantec Endpoint Protection Manager (SEPM) command status and
does NOT see an indicators of compromise (IOC) search command.
How is it possible that the search returned results?
An Incident Responder wants to create a timeline for a recent incident using Syslog in addition to ATP for the
After Actions Report.
What are two reasons the responder should analyze the information using Syslog? (Choose two.)
What is the role of Vantage within the Advanced Threat Protection (ATP) solution?
Which threat is an example of an Advanced Persistent Threat (APT)?
Which two (2 non-Symantec method for restricting traffic are available to the Incident response team?
Which level of privilege corresponds to each ATP account type?
Match the correct account type to the corresponding privileges.
How does an attacker use a zero-day vulnerability during the Incursion phase?
What are the prerequisite products needed when deploying ATP: Endpoint, Network, and Email?
What are two policy requirements for using the Isolate and Rejoin features in ATP? (Choose two.)
Which stage of an Advanced Persistent Threat (APT) attack do attackers break into an organization’s network
to deliver targeted malware?
While filling out the After Actions Report, an Incident Response Team noted that improved log monitoring could help detect future breaches.
What are two examples of how an organization can improve log monitoring to help detect future breaches? (Choose two.)
Where can an Incident Responder view Cynic results in ATP?
What occurs when an endpoint fails its Host Integrity check and is unable to remediate?
Which two non-Symantec methods for restricting traffic are available to the Incident Response team? (Choose two.)
