Are you worried about how to pass your Symantec 250-550 Exam? PassQuestion provides you with the best pathway to get through 250-550 Symantec Endpoint Security Planning Implementation and Administration R1 exam.With the help of the verified Symantec SCS 250-550 Exam Questions, you will learn how to increase your skills and help you revise certification syllabus, strengthen your learning and get real exam 250-550 questions format. You can also learn to manage time properly for the actual exam and get an excellent result.

Administration of Symantec Endpoint Security (SES) - R1

The certified candidate will demonstrate an understanding of the planning, designing, deploying and optimization of Symantec Endpoint Security. This understanding serves as a basis of technical knowledge and competency for the Symantec Endpoint Security solution in an enterprise environment.It is recommended that the candidate has at least 3-6 months experience working with Symantec Endpoint Security in a production or lab environment.

This exam targets IT Professionals using the Symantec Endpoint Security product in a Security Operations role. This certification exam tests the candidate's knowledge on how Symantec Endpoint Security provides cloud-delivered endpoint security with multilayered defense and single agent/single console management with AI-guided policy updates.

Exam Details:

Number of Questions: 65-75
Exam Duration: 90 minutes
Passing Score: 70%
Languages: English
Exam Price: $250 (or your country's currency equivalent)

Exam Objectives

Control endpoint protection from the cloud

• Describe the benefits of adopting a cloud-based endpoint security solution.
• Describe the account access and authentication methods available in SES.
• Describe the network requirements needed for connecting endpoints to the cloud management platform.
• Describe the client communication model and how to verify client connectivity.
• Describe the requirements and process for SEPM integration with the Cyber Defense Manager platform used in SES.
• Describe how content updates can be modified for various network configurations.
• Describe LiveUpdate functionality and configuration options

Maintain Security on all endpoints

• Describe the various methods SES uses to identify unmanaged endpoints.
• Describe the methods for enrolling SES endpoin agents.
• Describe the SES system requirements and supported operating systems.
• Describe how to utilize console data to identify and endpoints security status.

Protect endpoints against each phase of the attack chain

• Describe the various types of threats that threaten endpoint devices.
• Describe how SES can be used to protect endpoints against zero-day attacks.
• Describe how to use SES to block unauthorized applications from running.
• Describe device control and how SES can be used to control device access.
• Describe IPS and how it is used in detecting and preventing unwanted network traffic.
• Describe the signature-based protection model, it’s uses, advantages, and disadvantages.
• Describe various Memory Exploit Mitigation techniques and how SES protects against them.
• Describe the benefits of controlling network traffic on the endpoint and how SES uses firewall rules to fulfill these requirements.
• Describe SES content update types and how they are distributed to endpoints.

Respond to security threats

• Describe incident response stages for threat detections in an enterprise.
• Describe how the Cyber Defense Manager is used to identify threats in an environment.
• Describe the various types of device commands that can be sent to an endpoint agent and their use.
• Describe the steps that can be taken to remediate threats locally on an endpoint.
• Describe false positives, their impact, and how SES can be used to mitigate them.
• Describe the tools and techniques included in SES to adapt security policies based upon threat detections.
• Describe threat artifacts and the best practices to follow after a major endpoint security event.

Provide a recommended response for evolving and emerging threats

• Describe emerging threats and their impact in the current threat landscape.
• Describe Advanced Machine Learning and how SES employs this protection to protect endpoints against unknown threats.
• Describe the Cyber Defense Manager detection workflow, it’s operation and use.

Identify threats and systems involved in a Security Incident

• Describe how to use the SES management console to configure administrative notifications.
• Describe how to use the SES management console to configure administrative reports.
• Describe the Cyber Defense Manager security control dashboards and their use.
• Describe the advanced search and filtering capabilities of the Cyber Defense Manager.
• Describe how Virus Total Lookup can be used to gather detailed threat information SES.

Monitor change management for security controls

• Describe how an administrator can use SES policy versioning to help minimize unwanted system changes. 
• Describe the SES policy and device groups and how they are used.

View Online Administration of Symantec Endpoint Security (SES) - R1 250-550 Free Questions

An administrator learns of a potentially malicious file and wants to proactively prevent the file from ever being executed.
What should the administrator do?
A.Add the file SHA1 to a blacklist policy
B.Increase the Antimalware policy Intensity to Level 5
C.Add the filename and SHA-256 hash to a Blacklist policy
D.Adjust the Antimalware policy age and prevalence settings
Answer:D

Which SES advanced feature detects malware by consulting a training model composed of known good and known bad fries?
A.Signatures
B.Advanced Machine Learning
C.Reputation
D.Artificial Intelligence
Answer:B

What is the primary issue pertaining to managing roaming users while utilizing an on-premise solution?
A.The endpoint is missing timely policy update
B.The endpoint is absent of the management console
C.The endpoint fails to receive content update
D.The endpoint is more exposed to threats
Answer:C

Which report template out format should an administrator utilize to generate graphical reports?
A.XML
B.HTML
C.PFD
D.XML
Answer:B

An administrator suspects that several computers have become part of a botnet. What should the administrator do to detect botnet activity on the network?
A.Enable the Command and Control Server Firewall
B.Add botnet related signatures to the IPS policy's Audit Signatures list
C.Enable the IPS policy's Show notification on the device setting
D.Set the Antimalware policy's Monitoring Level to 4
Answer:A

In which phase of MITRE framework would attackers exploit faults in software to directly tamper with system memory?
A.Exfiltration
B.Discovery
C.Execution
D.Defense Evasion
Answer:D