Free Symantec 250-441 Exam Dumps Questions & Answers

An Incident Responder runs an endpoint search on a client group with 100 endpoints. After one day, the responder sees the results for 90 endpoints.
What is a possible reason for the search only returning results for 90 of 100 endpoints?

• A.  The search expired after one hour
• B.  10 endpoints are offline
• C.  10 endpoints restarted and cancelled the search
• D.  The search returned 0 results on 10 endpoints

Which two ATP control points are able to report events that are detected using Vantage?

What does a Quarantine Firewall policy enable an ATP Administrator to do?

• A.  Filter all traffic leaving the network
• B.  Intercept all traffic entering the network
• C.  Isolate a computer while it is manually being remediated
• D.  Submit files to a Central Quarantine server

An Incident Responder is going to run an indicators of compromise (IOC) search on the endpoints and wants to use operators in the expression.
Which tokens accept one or more of the available operators when building an expression?

• A.  Filename, Filehash, and Registry
• B.  Domainname, Filename, and Filehash
• C.  All tokens
• D.  Domainname and Filename only

An Incident Responder has reviewed a STIX report and now wants to ensure that their systems have NOT been compromised by any of the reported threats.
Which two objects in the STIX report will ATP search against? (Choose two.)

• A.  SHA-256 hash
• B.  SHA-1 hash
• C.  Registry entry
• D.  MD5 hash
• E.  MAC address