Question 1

Which type of event does operation:1indicate in a SEDR database search?

Options :

A : File Deleted.

B : File Closed.

C : File Open.

D : File Created.

Answer: C

Question 2

What EDR function minimizes the risk of an endpoint infecting other resources in the environment?

Options :

A : Quarantine

B : Block

C : Deny List

D : Firewall

Answer: A

Question 3

An administrator changes the Virus and Spyware Protection policy for a specific group that disables AutoProtect. The administrator assigns the policy and the client systems apply the corresponding policy serial number. Upon visual inspection of a physical client system, the policy serial number is correct. However, Auto-Protect is still enabled on the client system. Which action should the administrator take to ensure that the desired setting is in place for the client?

Options :

A : Restart the client system

B : Run a command on the computer to Update Content

C : Enable the padlock next to the setting in the policy

D : Withdraw the Virus and Spyware Protection policy

Answer: C

Question 4

What is the difference between running Device Control for a Mac versus Windows?

Options :

A : Mac Device Control runs at thedriver level.It enforces control only on Apple supported devices.

B :

Mac Device Control runs at thevolume level.It enforces control only on storage devices. OC.Mac Device Control runs at thekernel level.It enforces control only on built-in devices.

C : Mac Device Control runs at theuser level.It enforces control only on iCIoud storage.

Answer: B

Question 5

Which type of file attribute is valid for creating a block list entry with Symantec Endpoint Detection and Response (SEDR)?

Options :

A : SHA256

B : Type

C : Date Created

D : Filename

Answer: A