Question 1

What does the MITRE ATT&CK Matrix consist of?

Options :

A : Problems and Solutions

B : Attackers and Techniques

C : Tactics and Techniques

D : Entities and Tactics

Answer: C

Question 2

A company uses a remote administration tool that is detected as Hacktool.KeyLoggPro and quarantined by Symantec Endpoint Protection (SEP). Which step can an administrator perform to continue using the remote administration tool without detection by SEP?

Options :

A : Create a Tamper Protect exception for the tool

B : Create an Application to Monitor exception for the tool

C : Create a Known Risk exception for the tool

D : Create a SONAR exception for the tool

Answer: C

Question 3

What is the difference between running Device Control for a Mac versus Windows?

Options :

A : Mac Device Control runs at thedriver level.It enforces control only on Apple supported devices.

B : Mac Device Control runs at thevolume level.It enforces control only on storage devices. OC.Mac Device Control runs at thekernel level.It enforces control only on built-in devices.

C : Mac Device Control runs at theuser level.It enforces control only on iCIoud storage.

Answer: B

Question 4

What type of policy provides a second layer of defense, after the Symantec firewall?

Options :

A : Virus and Spyware

B : Host Integrity

C : Intrusion Prevention

D : System Lockdown

Answer: C

Question 5

What are the two (2) locations where an Incident Responder should gather data for an After Actions Report in SEDR? (Select two)

Options :

A : Incident Manager

B : Policies

C : Syslog

D : Action Manager

E : Endpoint Search

Answer: A,C

Higher Test Marks with Free Online 250-580 Exam Practice

Buying Options: