250-441 Practice Exam Questions and Answers

What are the prerequisite products needed when deploying ATP: Endpoint, Network, and Email?

A network control point discovered a botnet phone-home attempt in the network stream.

Which detection method identified the event?

An Incident Responder runs an endpoint search on a client group with 100 endpoints. After one day, the

responder sees the results for 90 endpoints.

What is a possible reason for the search only returning results for 90 of 100 endpoints?

An Incident responder added a files NDS hash to the blacklist.

Which component of SEP enforces the blacklist?

Which two ATP control points are able to report events that are detected using Vantage?

Enter the two control point names:

An Incident Responder notices traffic going from an endpoint to an IRC channel. The endpoint is listed in an

incident. ATP is configured in TAP mode.

What should the Incident Responder do to stop the traffic to the IRC channel?

Which prerequisite is necessary to extend the ATP: Network solution service in order to correlate email

detections?

What is the second stage of an Advanced Persistent Threat (APT) attack?

Which stage of an Advanced Persistent Threat (APT) attack do attackers map an organization’s defenses from the inside?

Which two user roles allow an Incident Responder to blacklist or whitelist files using the ATP manager?

(Choose two.)