Broadcom Endpoint Protection Admin Technical Specialist (250-605) Certification Sample Questions

01. Before rolling out a client upgrade, an administrator needs to know which releases of the client software the managed computers are currently running.
Which quick report should the administrator run?
a) Scan: Computers by Last Scan Time
b) Computer Status: Symantec Endpoint Protection Product Versions
c) Risk: New Risks Detected in the Network
d) Risk: Infected and at-risk computers

02. A Firewall policy rule has the action Allow and two triggers: an Application trigger naming the company's backup agent and a Host trigger naming the backup server. The backup agent now tries to send data to a different server that the rule does not name.
How does this rule treat that connection?
a) It allows it, because the application trigger alone is enough
b) It blocks it, because a Host trigger blocks every other host
c) It does not apply, because all of the rule's triggers must be true at once
d) It matches, because stateful inspection ties it to the agent

03. Months ago an administrator turned off inheritance on the Finance subgroup and then customized its policies and settings. The administrator now selects Inherit policies and settings from parent group on the Finance Policies tab again.
What happens to the policies and settings that were customized for Finance?
a) They are overwritten by the policies and settings of the parent group
b) They are kept and merged with the parent group's settings
c) They are kept, and only new parent changes flow down
d) They are moved to Default Group for later reuse

04. A site's management server has no access to the Internet or to an internal LiveUpdate server. Each week, as routine maintenance, an administrator carries definitions in on removable media so that the manager can update every client.
Which file should the administrator download?
a) A Rapid Release definitions .jdb file
b) A certified definitions .exe file
c) A Rapid Release definitions .exe file
d) A certified definitions .jdb file

05. A branch office reaches head office over a congested WAN link. Its managed clients use push mode for client-server communication, and the administrator wants to cut the bandwidth that this communication consumes. The branch can accept policy changes arriving with some delay.
Which change best meets this goal?
a) Set the branch clients to pull mode
b) Keep push mode, so changes arrive at once
c) Name a Group Update Provider to relay policy changes
d) Redeploy Sylink.xml to the clients with SylinkDrop

06. An analyst starts a Symantec EDR endpoint search, but several of the targeted endpoints are powered off and never respond.
What happens to the incomplete search?
a) It is converted into a database search of Events
b) It stays pending until the endpoints respond
c) It is resent through SEPM at the next heartbeat
d) It times out after a set period

07. A security team already knows the hash of a malicious tool used against the company. It wants Symantec EDR to flag that file on sight, based on the team's own known verdict rather than on runtime behavior or sandbox analysis.
Which detection technology best meets this need?
a) SONAR, which watches runtime behavior
b) Deny and allow lists
c) The suspicious file classifier
d) Cynic, the cloud-based sandbox

08. System lockdown is enforced in allow mode on a group. The administrator plans to remove an old application from the approved list. Before doing so, the administrator wants to see which clients still run it, while keeping lockdown enforced for everything else.
Which system lockdown option supports this?
a) Log Unapproved Applications Only
b) Collect File Fingerprint List
c) Test Before Removal
d) View Unapproved Applications

09. An administrator adds a limited administrator account for a contractor. Access will be decided later, so no access rights are selected when the account is saved.
What is the state of the new account?
a) It is created in a disabled state
b) It is enabled with read-only access to the Home page
c) It is enabled and inherits the rights of the default admin account
d) It is converted to an administrator for the Default domain

10. For a monthly threat review, a SOC lead wants two SEPM quick reports: one ranking which managed computers were hit most often by intrusion attempts from the network, and one showing which client computers currently carry a threat or remain exposed to one.
Which two reports should be run?
(Choose two.)
a) Scan: Computers Not Scanned
b) Network and Host Exploit Mitigation: Top Sources of Attack
c) Risk: Infected and at-risk computers
d) Network and Host Exploit Mitigation: Top Targets Attacked