Endpoint Security Complete - R2 Technical Specialist Free Sample Questions

This is the most secure and scalable solution. Using a trusted publisher certificate allows developers to sign their own compiled code, which Application Control will then trust. This avoids the insecurity of path-based exceptions (where malware could be placed), the potential over-permission of allowing any process from an IDE, and the administrative nightmare of constantly updating file hashes every time the code is recompiled.

While isolation and memory dumps are valid response actions, the immediate next step for investigation is to understand the scope. The Process Lineage view provides a graphical representation of the entire attack chain, from the initial email attachment to the PowerShell execution and any subsequent actions. This is the most efficient way to quickly grasp the full context before deciding on specific remediation or containment actions.

The Symantec Endpoint Protection Manager itself must be configured to use the proxy for its outbound communications to the cloud console. This is the primary location for setting up this connection.

For certain SEPM services and the enrollment process itself, SEPM relies on the Windows HTTP Services (WinHTTP). Configuring the proxy at this level ensures that all necessary components can reach the cloud services, supplementing the settings within the SEPM console.

This is the standard, supported method for managing air-gapped environments. The LUA server acts as an intermediary, downloading content from Symantec and placing it on an internal web or file share (distribution center). The GUP in the secure segment is then configured to pull from this internal location and distribute the updates to its peers. This is far more scalable and manageable than manual .jdb updates or setting up a full replication partner.

False. A Host Integrity failure does not automatically move a client to a different group. Instead, it typically triggers a firewall rule that applies a more restrictive 'Quarantine' firewall policy to the non-compliant client, limiting its network access until it meets the integrity requirements. The client remains in its original management group.

This is a critical distinction. SONAR monitors process behavior in real-time (API calls, memory access, etc.), not just files at rest. Standard file/folder exceptions are designed for file-based scanning engines. To prevent SONAR from flagging a legitimate application's behavior, a separate SONAR-specific exception (e.g., by application path or hash) must be created in the Exceptions policy.

The Symantec agent (sylink) runs under the local SYSTEM account. If the proxy server requires user-based authentication (e.g., domain credentials), the SYSTEM account will not have them, leading to an authentication failure (HTTP 407). The proxy credentials specified in the policy are often user-context specific and not available to the SYSTEM account. The solution is often to use a proxy that allows authentication based on machine account or IP address, or to configure proxy bypass for SEPM traffic.

The ICDm threat hunting query language uses a Lucene-like syntax. The correct format specifies the field (process.name), a colon, and the value (powershell.exe). The AND operator links conditions. For the command line, wildcards (*) are used to match the contained substrings effectively. The other options use incorrect operators (=, CONTAINS) or syntax for this specific interface.

This is the correct, layered approach. First, you block the entire class of devices you want to control ('USB Mass Storage Devices'), which is more efficient than blocking the generic 'USB' class. Then, you add specific, granular exclusions for the hardware you want to permit. Using the unique Device ID (or Hardware ID) for each company-issued encrypted drive ensures only those specific devices are allowed, fulfilling the security requirement precisely.

The sesinstaller.log is the primary troubleshooting tool for failed agent installations. It captures each action performed by the installer, from system checks and file copying to registry modifications and service creation. Any errors that cause the installation to fail or roll back will be recorded in this file, making it essential for diagnostics.