250-604 試験問題と解答 - 模擬練習 - 練習問題・模擬試験

Question No : 1
Which features contribute to blocking data exfiltration in SES Complete? (Choose two)

A.Network Integrity
B.Content Update Optimization
C.Data Loss Prevention Rules
D.Script Runner

正解:

Question No : 2
Which administrative practices support successful hybrid management of endpoints between SEPM and ICDm? (Choose two)

A.Documenting endpoint group membership and related policies in both systems
B.Monitoring policy conflict resolution logs after major updates
C.Limiting endpoint communication to SEPM during business hours
D.Using custom registry entries to enforce policy inheritance

正解:

Question No : 3
Which two steps must be completed to properly configure TDAD within SES Complete? (Choose two)

A.Deploy sensors on read-only domain controllers
B.Assign a TDAD policy to domain-joined endpoints
C.Install sensors on writable domain controllers
D.Enable the “Monitor Only” mode before enforcing policy

正解:

Question No : 4
Which two functions does the SES Complete Heatmap provide to administrators? (Choose two)

A.Real-time forensic packet capture
B.Visibility into application behavior across all devices
C.Identification of risky application behaviors
D.Direct firewall rule editing interface

正解:

Question No : 5
Which two benefits result from submitting suspicious files to the sandbox through EDR? (Choose two)

A.Prevention of local file sharing
B.Detailed behavioral analysis of the file in a safe environment
C.Immediate deletion of the file from all connected devices
D.Automated signature creation for future threats

正解:

Question No : 6
What is the primary requirement before initiating the installation of Threat Defense for Active Directory in an enterprise environment?

A.A minimum of one global exclusion policy must be created in ICDm.
B.The organizational unit must be registered as a managed domain controller.
C.An on-premises Domain Controller must be running and accessible to SES Complete.
D.The client computers must have administrator-level permissions to the endpoint recorder.

正解:

Question No : 7
Which update method ensures that endpoints are protected even during periods of disconnection from ICDm?

A.Real-time Sync
B.Local Content Distribution
C.On-Demand Update
D.Scheduled Reboot

正解:

Question No : 8
Scenario: Your enterprise supports a BYOD (Bring Your Own Device) policy. Security reports show a growing number of incidents involving mobile apps that access corporate resources and send data to unknown destinations.
Which two SES Complete features should you prioritize to address this issue? (Choose two)

A.Enable Network Integrity policies to monitor network behavior
B.Deploy device fingerprinting for OS patch verification
C.Scan mobile apps using behavioral threat detection
D.Disable cellular access via ICDm policy

正解:

Question No : 9
What are two key features of the EDR incident view in ICDm that assist in threat response? (Choose two)

A.Process tree visualization
B.Full packet capture viewer
C.File trajectory mapping
D.Bandwidth throttling interface

正解:

Question No : 10
Which ICDm feature provides a timeline of security-related events to assist security analysts in tracking the source and sequence of suspicious activities?

A.Activity Recorder
B.Policy Sync View
C.App Control Audit
D.Threat Log Viewer

正解:

Question No : 11
What update type is delivered to endpoints to ensure the latest threat intelligence is applied?

A.Feature Release
B.Policy Bundle
C.Content Update
D.OS Patch

正解:

Question No : 12
Which component in SES Complete helps identify unusual application behavior by providing a visual representation of behavioral prevalence?

A.App Control Dashboard
B.Policy Events Log
C.Behavioral Insights and Tuning Widget
D.Endpoint Activity Recorder

正解:

Question No : 13
Why should administrators regularly review the SES Complete Heatmap when implementing attack surface reduction strategies across an organization?

A.It identifies endpoints that have not been rebooted in over 30 days.
B.It visualizes policy compliance trends over time based on audit logs.
C.It provides a summary of all quarantined files in the last 24 hours.
D.It highlights devices exhibiting high-risk behaviors that may require policy adjustments.

正解:

Question No : 14
Which two types of activities are most commonly flagged by TDAD in an AD environment? (Choose two)

A.Brute-force login attempts
B.Changes in Group Policy Object links
C.Unauthorized creation of domain trust relationships
D.File encryption initiated by system services

正解:

Question No : 15
What is a key method used by TDAD to detect lateral movement in a Windows domain?

A.Monitoring NTFS permission changes
B.Analyzing Sysmon event logs
C.Detecting DNS tunneling behavior
D.Evaluating abnormal authentication paths between user accounts and systems

正解:

Symantec 250-604 問題練習