[更新されたのは2025年]Symantec 250-580問題準備には無料サンプルのPDF [Q49-Q66]

[更新されたのは2025年]Symantec 250-580問題準備には無料サンプルのPDF

2025年最新の認定サンプル問題250-580問題集と練習試験合格させます

質問 # 49
What happens when a device fails a Host Integrity check?

• A. The device is restarted
• B. An administrative notification is logged
• C. The device is quarantined
• D. An antimalware scan is initiated

正解：C

解説：
When a devicefails a Host Integrity checkin Symantec Endpoint Protection (SEP), it isquarantined. This means that the device's access to network resources may be restricted to prevent potential security risks from spreading within the network. Quarantine helps contain devices that do not meet the configured security standards, protecting the overall network integrity.
* Purpose of Quarantine on Host Integrity Failure:
* Host Integrity checks ensure that endpoint devices comply with security policies, such as having up-to-date antivirus signatures or required patches.
* If a device fails this check, quarantine limits its network connectivity, enabling remediation actions without exposing the network to possible risks from the non-compliant device.
* Why Other Options Are Less Suitable:
* Antimalware scans(Option A) anddevice restarts(Option B) are not default responses to integrity check failures.
* Administrative notifications(Option D) may be logged but do not provide containment as quarantine does.
References: Quarantining non-compliant devices is a standard response to Host Integrity check failures, ensuring network protection while remediation occurs.

質問 # 50
Which option should an administrator utilize to temporarily or permanently block a file?

• A. Encrypt
• B. Hide
• C. Delete
• D. Deny List

正解：D

解説：
Totemporarily or permanently block a file, the administrator should use theDeny Listoption. Adding a file to the Deny List prevents it from executing or being accessed on the system, providing a straightforward way to block suspicious or unwanted files.
* Functionality of Deny List:
* Files on the Deny List are effectively blocked from running, which can be applied either temporarily or permanently depending on security requirements.
* This list allows administrators to manage potentially malicious files by preventing them from executing across endpoints.
* Why Other Options Are Not Suitable:
* Delete(Option A) is a one-time action and does not prevent future attempts to reintroduce the file.
* Hide(Option B) conceals files but does not restrict access.
* Encrypt(Option C) secures the file's data but does not prevent access or execution.
References: The Deny List feature in Symantec provides a robust mechanism for blocking files across endpoints, ensuring controlled access.

質問 # 51
How would an administrator specify which remote consoles and servers have access to the management server?

• A. EdittheExternal Communication Settingsfor the Group under theClients tab.
• B. Edit theCommunication Settingsfor the Group under theClients tab.
• C. Edit theServer Propertiesand under theGeneral tab,change theServer Communication Permission.
• D. Edit theSite Propertiesand under theGeneral tab,change the server priority.

正解：C

解説：
To control which remote consoles and servers have access to theSymantec Endpoint Protection Management (SEPM) server, an administrator should edit theServer Propertiesand adjust theServer Communication Permissionunder the General tab. This setting specifies which remote systems are authorized to communicate with the management server, enhancing security by limiting access to trusted consoles and servers only. Adjusting the Server Communication Permission helps manage server access centrally and ensures only approved systems interact with the management server.

質問 # 52
How does IPS check custom signatures?

• A. IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine restarts checking for signatures.
• B. IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine logs the other signatures.
• C. IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine stops checking other signatures.
• D. IPS checks for signatures listed in the table. When a detection matches an inbound or outbound traffic packet, the IPS engine continues checking for other signatures.

正解：C

解説：
The Intrusion Prevention System (IPS) in Symantec Endpoint Protection operates by scanning inbound and outbound traffic packets against a defined list of signatures. This process aims to identify known attack patterns or anomalies that signify potential security threats.
When IPS detects a match in the traffic packet based on these custom signatures, the following sequence occurs:
* Initial Detection and Match:The IPS engine actively monitors traffic in real-time, referencing its signature table. Each packet is checked sequentially until a match is found.
* Halting Further Checks:Upon matching a signature with the inbound or outbound traffic, the IPS engine terminates further checks for other signatures in the same traffic packet. This design conserves system resources and optimizes performance by avoiding redundant processing once a threat has been identified.
* Action on Detection:After identifying and confirming the threat based on the matched signature, the IPS engine enforces configured responses, such as blocking the packet, alerting administrators, or logging the event.
This approach ensures efficient threat detection by focusing only on the first detected signature, which prevents unnecessary processing overhead and ensures rapid incident response.

質問 # 53
Which client log shows that a client is downloading content from its designated source?

• A. SesmLu.log
• B. Risk Log
• C. System Log
• D. Log.LiveUpdate

正解：D

解説：
TheLog.LiveUpdatelog shows details related tocontent downloadson a Symantec Endpoint Protection (SEP) client. This log captures the activities associated with updates, including:
* Content Source Information:It records the source from which the client downloads updates, whether from SEPM, a Group Update Provider (GUP), or directly from the LiveUpdate server.
* Download Progress and Status:This log helps administrators monitor successful or failed download attempts, along with version details of the downloaded content.
By reviewing the Log.LiveUpdate, administrators can verify if a client is correctly downloading content from its designated source.

質問 # 54
An administrator needs to identify infected computers that require a restart to finish remediation of a threat.
What steps in the SEPM should an administrator perform to identify and restart the systems?

• A. View the SONAR log to determine if any computers require a restart. Run a command from the Computer Status log to restart computers.
• B. View the Computer Status log to determine if any computers require a restart. Run a command from the SONAR log to restart computers.
• C. View the Computer Status log to determine if any computers require a restart. Run a command from the Risk log to restart computers.
• D. View the Computer Status log to determine if any computers require a restart. Run a command from the Attack log to restart computers.

正解：C

解説：
To identify computers that need a restart for completing threat remediation, the administrator should:
* Steps for Identification and Action:
* View the Computer Status login the Symantec Endpoint Protection Manager (SEPM) to see if any computers are flagged as needing a restart.
* Once identified, the administrator can go to theRisk logand run a command to initiate a restart on those systems, thereby completing the remediation process.
* Why This Method is Effective:
* TheComputer Status logprovides comprehensive information on the current state of each endpoint, including whether a restart is pending.
* Risk log commandsenable administrators to remotely trigger actions such as reboots on endpoints impacted by malware.
* Why Other Options Are Incorrect:
* Other options suggest using logs likeSONARorAttack logsto trigger restarts, which do not provide the necessary functionality for identifying and restarting systems in need of final remediation.
References: Using the Computer Status log along with the Risk log in SEPM ensures administrators can efficiently identify and restart infected systems.

質問 # 55
What is the result of disjointed telemetry collection methods used within an organization?

• A. False positives are seen
• B. Back of orchestration across controls
• C. Investigators lack granular visibility
• D. Attacks continue to spread during investigation

正解：C

解説：
Disjointed telemetry collection within an organization can result ina lack of granular visibilityfor investigators. Here's why this is problematic:
* Incomplete Data:Disjointed collection methods lead to fragmented data, making it difficult for security teams to get a complete picture of incidents.
* Reduced Investigation Efficiency:Without granular and cohesive telemetry, investigators struggle to trace the attack's path accurately, slowing down response times.
* Increased Risk of Missing Key Indicators:Critical indicators of compromise may be overlooked, allowing threats to persist or re-emerge in the environment.
Unified telemetry is essential for thorough and efficient investigations, as it provides the detailed insights necessary to understand and mitigate threats fully.

質問 # 56
Which two (2) criteria are used by Symantec Insight to evaluate binary executables? (Select two.)

• A. Confidentiality
• B. Prevalence
• C. Content
• D. Age
• E. Sensitivity

正解：B、D

解説：
Symantec Insight usesPrevalenceandAgeas two primary criteria to evaluate binary executables. These metrics help determine the likelihood that a file is either benign or malicious based on its behavior across a broad user base:
* Prevalence:This metric assesses how widely a file is used across Symantec's global community. Files with higher prevalence are generally more likely to be safe, while rare files may pose higher risks.
* Age:The age of a file is also considered. Older files with a stable reputation are less likely to be malicious, whereas newer, unverified files are scrutinized more closely.
Using these criteria, Symantec Insight provides reliable reputation ratings for binary files, enhancing endpoint security by preemptively identifying potential threats.

質問 # 57
An organization has a virtualized environment that is utilized by a group of Developers for testing. What feature can this organization utilize to optimize performance when running scheduled scans?

• A. Adjust Auto Protect Settings
• B. Randomize scheduled scans
• C. Use Shared Insight Cache in virtualized environments
• D. Disable early anti-malware (ELAM) detection

正解：C

解説：
In virtualized environments, Symantec Endpoint Protection (SEP) offersShared Insight Cache (SIC)as a feature to improve performance by reducing redundant scanning.
* Shared Insight Cache Functionality:
* SIC allows SEP clients in a virtual environment to share scan results. Once a file is scanned and deemed safe, that result is cached and shared across other SEP clients, preventing duplicate scans of the same file on different virtual machines (VMs).
* This caching mechanism is especially beneficial in environments where multiple VMs frequently use identical files, such as software libraries or system files.
* Optimized Performance:
* By reducing repetitive scanning, SIC minimizes CPU and disk usage, allowing virtualized environments to maintain performance even during scheduled scans.
* This approach is ideal for development and testing environments, where VM efficiency is crucial for productivity.
* Why Other Options Are Less Suitable:
* Disabling ELAM or adjusting Auto-Protect settings may reduce security or have limited impact on overall performance in a virtualized environment.
* Randomizing scheduled scans could help distribute resource load but does not prevent redundant scans across VMs.
References: The Shared Insight Cache is specifically designed to optimize SEP's performance in virtualized setups, as described in SEP's best practices for virtual environments.

質問 # 58
What permissions does the Security Analyst Role have?

• A. Trigger dumps, get & quarantine files, enroll new sites
• B. Trigger dumps, get & quarantine files, create device groups
• C. Search endpoints, trigger dumps, get & quarantine files
• D. Search endpoints, trigger dumps, create policies

正解：C

解説：
TheSecurity Analyst Rolein Symantec Endpoint Protection has permissions tosearch endpoints, trigger dumps, and get & quarantine files. These permissions allow security analysts to investigate potential threats, gather data for further analysis, and isolate malicious files as needed.
* Capabilities of the Security Analyst Role:
* Search Endpoints: Analysts can perform searches across endpoints to locate suspicious files or artifacts.
* Trigger Dumps: This allows analysts to create memory dumps or other forensic data for in-depth investigation.
* Get & Quarantine Files: Analysts can quarantine files directly from endpoints, thereby mitigating threats and preventing further spread.
* Why Other Options Are Incorrect:
* Enrolling new sites(Option A) andcreating device groups or policies(Options C and D) are typically reserved for administrators with broader access rights rather than for security analysts.
References: The Security Analyst Role focuses on investigative and response actions, such as searching, dumping, and quarantining files.

質問 # 59
Which type of communication is blocked, when isolating the endpoint by clicking on the isolate button in SEDR?

• A. Only SEP and SEDR network communications
• B. All non-SEP and non-SEDR network communications
• C. Only Web and UNC network communications
• D. All network communications

正解：B

解説：
When an endpoint is isolated inSymantec Endpoint Detection and Response (SEDR), the isolation blocks all network communication except for SEP and SEDR-related traffic. This selective blocking allows the endpoint to remain manageable by SEP and SEDR administrators while cutting off other potentially harmful network interactions.
* How Isolation Works:
* Isolation blocks allnon-SEP and non-SEDR network communications, effectively preventing the endpoint from connecting to or being accessed by other network entities.
* This method helps contain threats while keeping the endpoint connected to management servers for monitoring or further response actions.
* Why Other Options Are Incorrect:
* All network communications(Option B) would prevent SEP/SEDR management traffic, which is contrary to the design.
* Only SEP and SEDR network communications(Option C) is incorrect as it implies only SEP and SEDR are blocked, while in reality, all other traffic is blocked.
* Only Web and UNC network communications(Option D) does not cover the full extent of the isolation functionality.
References: SEDR's isolation capabilities provide a controlled response mechanism that allows secure management access while containing threats.

質問 # 60
An administrator is investigating a possible threat that occurs during the Windows startup. A file is observed that is NOT digitally signed by Microsoft. Which Anti-malware feature should the administrator enable to scan this file for threats?

• A. Enable Behavioral Analysis
• B. Enable Microsoft ELAM
• C. Enable Auto-Protect
• D. Enable Early Launch Antimalware

正解：D

解説：
Early Launch Antimalware (ELAM)is a feature that is designed to provideanti-malware protection during the early stages of Windows startup. When ELAM is enabled, it scans drivers and files that load during startup, especially those not digitally signed by trusted sources like Microsoft.
* How ELAM Works:
* ELAM loads before other drivers at startup and scans critical files and drivers, identifying potential malware that may attempt to execute before other security layers are fully operational.
* Since the file observed is not digitally signed by Microsoft, ELAM would detect and analyze it at boot, preventing possible threats from initializing.
* Advantages of ELAM:
* It provides proactive defense against rootkits and other threats that may try to gain persistence on the system by loading during the Windows boot process.
* Why Other Options Are Less Suitable:
* Auto-ProtectandBehavioral Analysisare effective but operate after the system has booted.
* Microsoft ELAMis already enabled by default in Windows but does not provide the same customizability as SEP's ELAM feature.
References: Enabling ELAM is a key best practice for SEP to secure the earliest startup stages against unsigned or suspicious files.

質問 # 61
Which type of event does operation:1indicate in a SEDR database search?

• A. File Open.
• B. File Deleted.
• C. File Closed.
• D. File Created.

正解：A

解説：
In aSymantec Endpoint Detection and Response (SEDR)database search, an event labeled withoperation:1 corresponds to aFile Openaction. This identifier is part of SEDR's internal operation codes used to log file interactions. When querying or analyzing events in the SEDR database, recognizing this code helps Incident Responders understand that the action recorded was an attempt to access or open a file on the endpoint, which may be relevant in tracking suspicious or malicious activities.

質問 # 62
What protection technologies should an administrator enable to protect against Ransomware attacks?

• A. Firewall, Host Integrity, System Lockdown
• B. IPS, SONAR, and Download Insight
• C. SONAR, Firewall, Download Insight
• D. IPS, Firewall, System Lockdown

正解：B

解説：
To effectively protect againstRansomware attacks, an administrator should enable the following Symantec Endpoint Protection (SEP) technologies:
* IPS (Intrusion Prevention System):IPS detects and blocks network-based ransomware attacks, preventing exploitation attempts before they reach the endpoint.
* SONAR (Symantec Online Network for Advanced Response):SONAR provides real-time behavioral analysis, identifying suspicious activity characteristic of ransomware, such as unauthorized file modifications.
* Download Insight:This technology helps prevent ransomware by evaluating the reputation of files downloaded from the internet, blocking those with a high risk of infection.
Together, these technologies offer comprehensive protection against ransomware by covering network, behavior, and download-based threat vectors.

質問 # 63
The LiveUpdate Download Schedule is set to the default on the Symantec Endpoint Protection Manager (SEPM).
How many content revisions must the SEPM keep to ensure clients that check in to the SEPM every 10 days receive xdelta content packages instead of full content packages?

• A. 0
• B. 1
• C. 2
• D. 3

正解：B

解説：
To ensure that clients checking in every 10 days receivexdelta content packagesinstead of full content packages,30 content revisionsmust be retained on the Symantec Endpoint Protection Manager (SEPM). Here' s why:
* Incremental Updates:xdelta packages are incremental updates that only download changes since the last update, conserving bandwidth and speeding up client updates.
* Content Revision Retention:SEPM needs to retain a sufficient number of content revisions to allow clients that check in intermittently (such as every 10 days) to download incremental rather than full content packages.
* Default Retention Recommendation:Retaining 30 content revisions ensures that clients are covered for up to 10 days of updates, meeting the requirement for xdelta delivery.
This setup optimizes resource usage by reducing the load on network and client systems.

質問 # 64
What EDR feature provides endpoint activity recorder data for a file hash?

• A. Process Dump
• B. Hash Dump
• C. Entity Dump
• D. Full Dump

正解：C

解説：
In Symantec Endpoint Detection and Response (EDR), theEntity Dumpfeature provides detailed activity recorder data related to a specific file hash. This data is essential for understanding the behavior and origin of a suspicious file, as well as tracking its activity across endpoints. Here's how it works:
* Hash-Based Search:The EDR solution allows the administrator to search by file hash, which helps retrieve a history of the file's interactions and activities.
* Entity Dump Retrieval:Selecting the Entity Dump option provides comprehensive data, including process execution, file modification, network connections, and other endpoint interactions related to the file.
* Enhanced Threat Analysis:By analyzing this information, the administrator gains insights into how the threat may have propagated, aiding in containment and mitigation efforts.
The Entity Dump is thus a vital tool in forensic analysis, providing detailed endpoint activity data for specified file hashes.

質問 # 65
What type of policy provides a second layer of defense, after the Symantec firewall?

• A. Host Integrity
• B. System Lockdown
• C. Virus and Spyware
• D. Intrusion Prevention

正解：D

解説：
TheIntrusion Prevention System (IPS)provides asecond layer of defenseafter the Symantec firewall. While the firewall controls access and traffic flow at the network perimeter, IPS actively monitors and inspects incoming and outgoing traffic for signs of malicious activity, such as exploit attempts and suspicious network patterns.
* How IPS Complements the Firewall:
* The firewall acts as the first layer of defense, blocking unauthorized access based on rules and policies.
* IPS then inspects allowed traffic in real-time, identifying and blocking attacks that may evade basic firewall rules, such as known exploits and abnormal network behaviors.
* Why Other Options Are Less Effective:
* Virus and Spyware(Option A) focuses on malware detection within files and programs, not network defense.
* Host Integrity(Option B) is related to compliance, andSystem Lockdown(Option D) controls application execution but does not monitor network traffic.
References: Intrusion Prevention adds a critical layer of defense in Symantec's network security stack, working in conjunction with the firewall for comprehensive protection.

質問 # 66
......

250-580豪華セット学習ガイドにはオンライン試験エンジン：https://www.passtest.jp/Symantec/250-580-shiken.html

250-580テスト準備トレーニング練習試験問題練習テスト：https://drive.google.com/open?id=1_YNu1sKCm2CDwN7qtbsv3zcoyRtafTKr