250-580 Practice Questions

Active Directory (AD) is commonly targeted in attacks because it serves as a central directory for user

identities, applications, and resources accessible across the network. This visibility makes it an

attractive target for attackers to exploit for lateral movement, privilege escalation, and

reconnaissance. Once compromised, AD provides attackers with significant insight into an

organization’s internal structure, enabling further exploitation and access to sensitive data.

Threat Defense for Active Directory (TDAD) employs Honeypot Traps as a primary prevention

technique to detect and expose attackers. These honeypot traps act as decoys within the network,

mimicking legitimate Active Directory (AD) objects or data that would attract attackers aiming to

gather AD information or exploit AD weaknesses.

Honeypot Trap Functionality:

Honeypot traps are strategically placed to appear as appealing targets, such as privileged accounts or

critical directories, without being part of the actual AD infrastructure.

When attackers interact with these traps, TDAD records their actions, which can then trigger alerts,

allowing administrators to identify and monitor suspicious activities.

Exposure and Mitigation:

By enticing attackers to interact with fake assets, honeypot traps help expose malicious intentions

and techniques. This information can be used for forensic analysis and to enhance future defenses.

This technique allows organizations to expose potential threats proactively, before any real AD

resources are compromised.

Reference: This approach is part of Symantec’s Active Directory security strategies and utilizes

honeypot mechanisms to deter and identify intruders in real-time​.

To integrate Symantec Endpoint Detection and Response (SEDR) with Symantec Endpoint Protection

(SEP) effectively, the recommended configuration order is ECC, Synapse, then Insight Proxy.

Order of Configuration:

ECC (Endpoint Communication Channel): This establishes the communication layer for SEDR and SEP

integration, which is foundational for data exchange.

Synapse: This integration uses data from ECC to correlate threat intelligence and provide context to

detected threats.

Insight Proxy: Configured last, Insight Proxy adds cloud-based file reputation lookups, enhancing

detection capabilities with reputation scoring.

Why This Order is Effective:

Each component builds on the previous one, maximizing the value of integration by ensuring that

foundational communication (ECC) is established before adding Synapse correlation and Insight

Proxy reputation data.

Reference: Configuring ECC, Synapse, and Insight Proxy in this order is considered best practice for

optimizing integration benefits between SEDR and SEP​.

The maximum number of Symantec Endpoint Protection Managers (SEPMs) that a single

Management Platform can connect to is 50. This limit ensures that the management platform can

handle communication, policy distribution, and reporting across connected SEPMs without

overloading the system.

Significance of the 50 SEPM Limit:

This limitation is in place to ensure stable performance and effective management, especially in

large-scale deployments where multiple SEPMs are required to support extensive environments.

Relevance in Large Enterprises:

Organizations managing endpoints across multiple locations often use several SEPMs, and the

platform’s 50-manager limit allows scalability while maintaining centralized management.

Reference: The SEPM connection limits are documented as part of the architecture specifications for

Symantec Endpoint Protection​.

To notify administrators of performance issues on the SEPM, they should add a Server health alert.

This type of alert is specifically designed to monitor the health of the SEPM, triggering notifications

when performance drops or errors occur.

Configuration Steps:

Set up a Server health alert in the SEPM, specifying the conditions that define poor server health.

Configure the alert frequency and designate an email address for notifications, ensuring that

administrators receive timely updates.

Why Other Options Are Incorrect:

System event alerts (Option A) cover general system events but are less specific to performance.

Authentication alerts (Option B) focus on login and access issues.

Client security alerts (Option C) are related to endpoint security rather than SEPM server

performance.

Reference: Server health alerts are tailored for monitoring SEPM’s performance, making them the

ideal choice for tracking server health​.

Dark Corners alarms are part of Threat Defense for Active Directory and are triggered when domain

misconfigurations or hidden backdoors are detected within the directory environment. Here’s how

this alarm functions:

Detection of Hidden Threats: Dark Corners identifies and alerts administrators to hidden

vulnerabilities within the Active Directory, such as unauthorized access paths or misconfigurations

that could be exploited.

Security Assurance: By identifying these issues, administrators can proactively address and rectify

potential risks that are otherwise challenging to detect.

Improved Active Directory Security: The Dark Corners alarm helps ensure that backdoors and

misconfigurations do not provide attackers with hidden access points, strengthening the overall

security posture of Active Directory.

This feature allows for a deeper level of inspection within Active Directory, safeguarding against

subtle yet critical security risks.

A Rootkit is a type of security threat that can persist across system reboots, making it difficult to

detect and remove. Rootkits operate by embedding themselves deep within the operating system,

often at the kernel level, and they can disguise their presence by intercepting and modifying

standard operating system functionality. Here’s how they maintain persistence:

Kernel-Level Integration: Rootkits modify core operating system files, allowing them to load during

the boot process and remain active after reboots.

Stealth Techniques: By hiding from regular security checks, rootkits avoid detection by conventional

anti-virus and anti-malware tools.

Persistence Mechanism: The modifications rootkits make ensure they start up again after each

reboot, enabling continuous threat activity on the compromised system.

Due to their persistence and stealth, rootkits present significant challenges for endpoint security.

Application Control in Symantec Endpoint Protection (SEP) provides the SEP team with the ability to

control and monitor the behavior of applications. This technology enables administrators to set

policies that restrict or allow specific application behaviors, effectively controlling the environment

and reducing risk from unauthorized or harmful applications. Here’s how it works:

Policy-Based Controls: Administrators can create policies that define which applications are allowed

or restricted, preventing unauthorized applications from executing.

Behavior Monitoring: Application Control can monitor application actions, detecting unusual or

potentially harmful behaviors and alerting administrators.

Enhanced Security: By controlling application behavior, SEP helps mitigate threats by preventing

suspicious applications from affecting the environment, which is particularly valuable in post-

outbreak recovery and ongoing health checks.

Application Control thus strengthens endpoint defenses by enabling real-time management of

application behaviors.

The Security Analyst Role in Symantec Endpoint Protection has permissions to search endpoints,

trigger dumps, and get & quarantine files. These permissions allow security analysts to investigate

potential threats, gather data for further analysis, and isolate malicious files as needed.

Capabilities of the Security Analyst Role:

Search Endpoints: Analysts can perform searches across endpoints to locate suspicious files or

artifacts.

Trigger Dumps: This allows analysts to create memory dumps or other forensic data for in-depth

investigation.

Get & Quarantine Files: Analysts can quarantine files directly from endpoints, thereby mitigating

threats and preventing further spread.

Why Other Options Are Incorrect:

Enrolling new sites (Option A) and creating device groups or policies (Options C and D) are typically

reserved for administrators with broader access rights rather than for security analysts.

Reference: The Security Analyst Role focuses on investigative and response actions, such as

searching, dumping, and quarantining files​.

When a malicious file is deleted from an endpoint, registry entries that point to that file may also be

deleted as part of the remediation process. Removing associated registry entries helps ensure that

remnants of the malicious file do not remain in the system, which could otherwise allow the malware

to persist or trigger errors if the system attempts to access the deleted file.

Why Registry Entries are Deleted:

Malicious software often creates registry entries to establish persistence on an endpoint. Deleting

these entries as part of the file removal process prevents potential reinfection and removes any

to the deleted file, which aids in full remediation.

Why Other Options Are Incorrect:

Incidents related to the file (Option B) are tracked separately and typically remain in logs for

historical reference.

SEP Policies (Option C) are not associated with specific files and thus are unaffected by file deletion.

Files and libraries that point to the file (Option D) are not automatically deleted; only direct registry

entries related to the file are addressed.

Reference: Deleting registry entries associated with malicious files is a standard practice in endpoint

protection to ensure comprehensive threat removal​.