Pass the Symantec Certified Specialist 250-441 Questions and answers with ExamsMirror

Periodically log into the ATP manager and review only the Dashboard.

Implement IT Analytics to create more flexible reporting.

Dedicate an administrator to monitor new events as they flow into the ATP manager.

Set email notifications in the ATP manager to message the Security team when a new incident is occurring.

Implement Syslog to aggregate information from other systems, including ATP, and review log data in a single console.

Use the isolation command in ATP to move endpoint to quarantine network.

Blacklist suspicious domain in the ATP manager.

Deploy a high-Security antivirus and Antispyware policy in the Symantec Endpoint protection Manager (SEPM.)

Create a firewall rule in the Symantec Endpoints Protection Manager (SEPM) or perimeter firewall that blocks

traffic to the domain.

Run a full system scan on all endpoints

Events

Dashboard

File Details

Incident Details

Administrator

Controller

User

Incident Responder

Root

To have less raw data to analyze

To evaluate the data, including information from other systems

To access expanded historical data

To determine what policy settings to modify in the Symantec Endpoint Protection Manager (SEPM)

To determine the best cleanup method

Reputation-based security

Event correlation

Network detection component

Detonation/sandbox

The Incident Response team is identifying the scope of the infection and is gathering a list of infected systems.

The Incident Response team is reviewing detections in the risk logs and assigning a High-Security Antivirus and Antispyware policy in the Symantec Endpoint Protection Manager (SEPM).

The Incident Response team completed their analysis of the threat and added it to a blacklist.

The Incident Response team is analyzing the file to determine if it is a threat or a false positive.

Email Security.cloud credentials for email correlation, credentials for the Symantec Endpoint Protection Manager (SEPM) database, and a System Administrator login for the SEPM

Active Directory login to the Symantec Endpoint Protection Manager (SEPM) database, and an Email Security.cloud login with full access

Symantec Endpoint Protection Manager (SEPM) login and ATP: Email login with service permissions

Credentials for the Symantec Endpoint Protection Manager (SEPM) database, and an administrator login for Symantec Messaging Gateway

Blacklist

Whitelist

Delete file

Submit file to Cynic

Assign a High-Security Antivirus and Antispyware policy in the Symantec Endpoint Protection Manager

(SEPM).

Run an indicators of compromise (IOC) search in ATP manager.

Create a firewall rule in the Symantec Endpoint Protection Manager (SEPM) or perimeter firewall that

blocks traffic to the domain.

Add the site to a blacklist in ATP manager.