A large company has 150,000 endpoints with 12 SEP sites across the globe. The company now wants to
implement ATP: Endpoint to improve their security. However, a consultant recently explained that the company needs to implement more than one ATP manager.
Why does the company need more than one ATP manager?
ATP detects a threat phoning home to a command and control server and creates a new incident. The treat is NOT being detected by SEP, but the Incident Response team conducted an indicators of compromise (IOC) search for the machines that are contacting the malicious sites to gather more information.
Which step should the Incident Response team incorporate into their plan of action?
Which access credentials does an ATP Administrator need to set up a deployment of ATP: Endpoint, Network, and Email?
A medium-sized organization with 10,000 users at Site A and 20,000 users at Site B wants to use ATP:
Network to scan internet traffic at both sites.
Which physical appliances should the organization use to act as a network scanner at each site while using the fewest appliances and assuming typical network usage?
During a recent virus outlook, an Incident found that the incident Response team was successful in identifying malicious that were communicating with the infected endpoint.
Which two (2) options should be incident Responder select to prevent endpoints from communicating with malicious domains?
What is the role of Cynic within the Advanced Threat Protection (ATP) solution?
An Incident Responder wants to use a STIX file to run an indicate of components (IOC) search.
Which format must the administrator use for the file?
Which default port does ATP use to communicate with the Symantec Endpoint Protection Manager (SEPM)
web services?
Which stage of an Advanced Persistent Threat (APT) attack do attackers break into an organization’s network
to deliver targeted malware?
Why is it important for an Incident Responder to copy malicious files to the ATP file store or create an image of the infected system during the Recovery phase?
