250-605 PDF問題集で2026年08月12日最近更新された問題
250-605試験問題有効な250-605問題集PDF
質問 # 39
Which policy component in SEP defines how Windows clients scan for viruses and spyware in real time?
- A. Host Integrity Policy
- B. Windows Virus and Spyware Protection Policy
- C. Firewall Policy
- D. Application and Device Control Policy
正解：B
質問 # 40
Which two advantages does deploying a LiveUpdate Administrator (LUA) provide in enterprise environments?
(Choose two)
- A. Built-in client-side antivirus scanning
- B. Reduced WAN traffic from clients to the internet
- C. Faster LiveUpdate GUI launch
- D. Centralized control over which content types are downloaded
正解：B、D
質問 # 41
How can an analyst use the Evidence Table during an investigation in SEDR?
- A. To view event logs generated by the SEPM
- B. To delete false positives directly from the database
- C. To organize and correlate all detected evidence related to a threat
- D. To list only infected endpoints
正解：C
質問 # 42
Which SEP feature allows administrators to exclude specific files, folders, or applications from being scanned or blocked by protection technologies?
- A. Security Exceptions
- B. Host Integrity Policy
- C. LiveUpdate Content Exceptions
- D. Application Control
正解：A
質問 # 43
How does policy inheritance function within SEPM client groups by default?
- A. Policies are only inherited if clients are unmanaged
- B. Policies are inherited from the parent group unless explicitly overridden
- C. Child groups override all inherited policies automatically
- D. Policy inheritance is disabled until manually enabled
正解：B
質問 # 44
Which feature of SEP allows administrators to block USB storage devices on both Windows and Mac clients?
- A. Device Control
- B. SONAR Protection
- C. Host Integrity
- D. Application Control
正解：A
質問 # 45
Which SEPM view determines which computers have the latest policies and virus definitions?
- A. The Client view
- B. The Summary view
- C. The Policies view
- D. The Health Check view
正解：A
質問 # 46
When exporting SEDR incident reports for audit purposes, which format is typically supported?
- A. DOCX
- B. PPT
- C. XML only
- D. PDF
正解：D
質問 # 47
What are two key settings that can be defined when configuring SEPM notification conditions?
(Choose two)
- A. Action to take (e.g., quarantine file)
- B. Type of event (e.g., Virus found, Policy non-compliance)
- C. Hourly billing rate for impacted hosts
- D. Method of alert delivery (e.g., email, SNMP trap)
正解：B、D
質問 # 48
Which factor most influences the data retention duration in a SEDR environment?
- A. Number of policies deployed
- B. Volume of telemetry data generated per endpoint
- C. Size of the system image
- D. Frequency of LiveUpdate definitions
正解：B
質問 # 49
How can SEDR event data be forwarded to external systems for further analysis?
- A. Using syslog over TCP/UDP
- B. By FTP transfer
- C. Via USB export only
- D. Through SQL-based report triggers
正解：A
質問 # 50
Which SEPM feature is used to alert administrators about specific security events, such as outbreak detections or policy violations?
- A. Risk Log
- B. Command Queue
- C. Replication Schedule
- D. Notification Conditions
正解：D
質問 # 51
Which two pieces of information can be viewed when monitoring content distribution in SEPM?
(Choose two)
- A. The version number of virus definitions on the client
- B. The total storage capacity of the client machine
- C. The client's last successful content update time
- D. The client's scheduled scan history
正解：A、C
質問 # 52
What must be done before a client can function as a Group Update Provider?
- A. Promote the client to a domain controller
- B. Add the client IP to the Symantec firewall rule set
- C. Install the LiveUpdate Administrator (LUA) service on the client
- D. Configure the client as a GUP in the LiveUpdate policy
正解：D
質問 # 53
What is the primary goal of the Memory Exploit Mitigation (MEM) feature in Symantec Endpoint Protection (SEP)?
- A. To block removable device access
- B. To reduce memory usage by SEP services
- C. To limit JavaScript execution in browsers
- D. To detect and prevent memory-based exploit techniques such as ROP attacks
正解：D
質問 # 54
Which two configurations must be in place for SEDR to accurately detect and classify threats?
(Choose two)
- A. SEDR Management Console must be running on HTTPS
- B. SEPM must be running in high-availability mode
- C. Endpoint Activity Recorder must be configured and active
- D. SEP clients must have telemetry and logging enabled
正解：C、D
質問 # 55
What is the role of a "Site" in the Symantec Endpoint Protection Manager (SEPM) architecture?
- A. It defines physical office locations for deploying SEP
- B. It represents a logical container for SEPMs sharing a single database
- C. It manages firewall rules for separate client networks
- D. It allows for isolation of clients based on IP address
正解：B
質問 # 56
During a successful integration between SEDR and SEPM, which two data streams are shared to enhance EDR functionality?
(Choose two)
- A. Policy compliance violations
- B. Endpoint scan logs
- C. Telemetry data and event metadata
- D. Patch deployment schedules
正解：B、C
質問 # 57
What is the primary business objective of integrating Symantec Endpoint Detection and Response (SEDR) into an enterprise security environment?
- A. To centralize data backup and disaster recovery
- B. To automate system patching across remote clients
- C. To detect, investigate, and respond to advanced persistent threats
- D. To manage endpoint licenses across domains
正解：C
質問 # 58
What priority would an incident that may have an impact on business be considered?
- A. Critical
- B. Medium
- C. High
- D. Low
正解：B
質問 # 59
Which function do user-managed certificates serve in the SEDR environment?
- A. They ensure secure communication between SEDR and external systems
- B. They replace the default SEP antivirus signature
- C. They activate administrator roles in SEPM
- D. They store log archives securely
正解：A
質問 # 60
When reviewing EAR data, what behavior would be considered a strong indication of credential theft?
- A. File creation in the temporary internet cache
- B. A user logging in outside of working hours
- C. An application repeatedly opening a local PDF file
- D. An executable accessing lsass.exe with process injection
正解：D
質問 # 61
How does SEDR facilitate threat eradication across the environment?
- A. By automatically updating SEP licenses
- B. By enabling Windows Event Log forwarding
- C. By deploying email-based phishing simulators
- D. By allowing administrators to remove malicious files remotely
正解：D
質問 # 62
What must be configured in SEPM to ensure effective threat detection by SEDR?
- A. Forward logs and telemetry data to the SEDR appliance
- B. Assign a default domain administrator role
- C. Enable Auto-Protect Scan only
- D. Disable client integrity checking
正解：A
質問 # 63
How are role-based access controls (RBAC) implemented in the SEDR Management Console?
- A. Through Active Directory domain trust inheritance
- B. By associating users with built-in roles that determine access scope
- C. By assigning IP-based firewall rules to each admin
- D. By configuring LDAP password hash exclusions
正解：B
質問 # 64
......
250-605問題集合格確定させる練習には169問があります：https://www.passtest.jp/Symantec/250-605-shiken.html