Pass 250-580 Exam Guide

Symantec Insighttechnology can prevent the download of unknown executables through a browser session by leveraging a cloud-based reputation service. Insight assesses the reputation of files based on data collected from millions of endpoints, blocking downloads that are unknown or have a lowreputation. This technology is particularly effective against zero-day threats or unknown files that do not yet have established signatures.

Toblock facebook.com use during business hours, the SEP administrator should configure theAction, Hosts(s), and Schedulecomponents within the Firewall rule.

Explanation of Each Component:

Action: Set to "Block" to deny access to the specified site.

Hosts(s): Specify facebook.com as the target host, ensuring that all traffic to this domain is blocked.

Schedule: Define the rule to apply only during business hours, ensuring that access is restricted within the designated time frame.

Why Other Options Are Incorrect:

Network InterfaceandNetwork Service(Options A and B) are not specific to blocking domain access.

Application(Options B and D) is unnecessary if the goal is to block access based on domain and schedule.

References: Configuring Action, Hosts, and Schedule within SEP firewall rules enables precise access control based on time and target domain​.

TheProcess Lineage Widgetin the Incident View of Symantec Endpoint Security provides a visual representation of theparent-child relationshipamong related security events, such as processes or activities stemming from a primary malicious action. This widget is valuable for tracing the origins and propagation paths of potential threats within a system, allowing security teams to identify the initial process that triggered subsequent actions. By displaying this hierarchical relationship, the Process Lineage Widget supports in-depth forensic analysis, helping administrators understand how an incident unfolded and assess the impact of each related security event in context.

In Symantec Endpoint Detection and Response (SEDR), thetimeout for the file deletion commandis set to72 hours (3 days). This means that once a deletion command is issued, it remains active for 72 hours, allowing sufficient time for the command to execute, especially in scenarios where the endpoint may not immediately respond due to network issues or system unavailability.

References: This configuration aligns with Symantec’s endpoint response protocols for command timeout windows in SEDR systems​.