250-580 Sample Questions & Answers

This is a critical distinction. SONAR monitors process behavior in real-time (API calls, memory access, etc.), not just files at rest. Standard file/folder exceptions are designed for file-based scanning engines. To prevent SONAR from flagging a legitimate application's behavior, a separate SONAR-specific exception (e.g., by application path or hash) must be created in the Exceptions policy.

The Symantec agent (sylink) runs under the local SYSTEM account. If the proxy server requires user-based authentication (e.g., domain credentials), the SYSTEM account will not have them, leading to an authentication failure (HTTP 407). The proxy credentials specified in the policy are often user-context specific and not available to the SYSTEM account. The solution is often to use a proxy that allows authentication based on machine account or IP address, or to configure proxy bypass for SEPM traffic.

The ICDm threat hunting query language uses a Lucene-like syntax. The correct format specifies the field (process.name), a colon, and the value (powershell.exe). The AND operator links conditions. For the command line, wildcards (*) are used to match the contained substrings effectively. The other options use incorrect operators (=, CONTAINS) or syntax for this specific interface.

This is the correct, layered approach. First, you block the entire class of devices you want to control ('USB Mass Storage Devices'), which is more efficient than blocking the generic 'USB' class. Then, you add specific, granular exclusions for the hardware you want to permit. Using the unique Device ID (or Hardware ID) for each company-issued encrypted drive ensures only those specific devices are allowed, fulfilling the security requirement precisely.

The sesinstaller.log is the primary troubleshooting tool for failed agent installations. It captures each action performed by the installer, from system checks and file copying to registry modifications and service creation. Any errors that cause the installation to fail or roll back will be recorded in this file, making it essential for diagnostics.

The Integrated Cyber Defense Manager (ICDm) cloud console has a built-in feature to forward security events to an external Syslog server, which is a standard ingestion method for most SIEM platforms.

SES Complete provides a robust REST API that allows for programmatic access to event data. A SIEM platform can use its API connector to periodically poll for and ingest new events, providing a flexible and powerful integration method.

This rule is the most specific and adheres to the principle of least privilege. It restricts the communication by application (billing.exe), protocol (TCP), direction (outbound), destination host (10.10.5.25), and destination port (1433). The other options are overly permissive and create unnecessary security risks.

The 'Computer Status' report is the correct tool for this task. It provides detailed information about the state of clients, including their compliance status. By filtering this report to show only 'Non-compliant' computers and focusing on Host Integrity failures, the administrator can generate the precise list required for the audit.

True. System Lockdown in whitelist mode is extremely strict. It works from a list of known-good application file fingerprints (hashes). Any executable that is not on this list is blocked from running. This includes legitimate OS patches and software updates. Administrators must carefully manage the fingerprint list, updating it before deploying any system or application updates to avoid disruption.

Memory Exploit Mitigation (MEM) is purpose-built to counter memory-based, fileless attacks. It monitors legitimate applications for exploit-like behavior (such as ROP attacks, stack pivots, and heap sprays) and terminates the process before it can be compromised. Injecting code into a critical system process like lsass.exe is a classic technique that MEM is designed to prevent.