Broadcom Endpoint Security Complete Admin Technical Specialist (250-614) Certification Sample Questions

01. An administrator suspects that a file flagged as a suspicious high-risk file is actually an approved internal tool, so it should not go on the Deny List yet.
Where does ICDm list such files for review?
a) Generated Reports
b) My Tasks
c) Alert Rules
d) Command Status

02. A security team suspects that an attacker on a compromised workstation is Kerberoasting: requesting service tickets for domain service accounts so that their passwords can be cracked offline.
Which SES Complete feature is documented to detect Kerberoasting attempts?
a) Intrusion Prevention
b) Adaptive Protection
c) Threat Defense for Active Directory
d) Memory Exploit Mitigation

03. To reduce initial access through removable media, an administrator adds a Device Control rule that blocks all USB devices on Windows endpoints. Users then report that their USB mice no longer work.
What should the administrator change?
a) Allow the mouse in a rule placed above the USB block rule
b) Add the mouse driver's hash to the Allow List policy
c) Put the USB block rule above a new rule allowing the mouse
d) Add a policy target rule that exempts devices with a mouse

04. An administrator maintains several Application Control policies for different point-of-sale device groups. All of them need the same allow rules for the approved checkout applications, kept in one place.
What should the administrator create?
a) A policy group holding the policies
b) A policy target rule for each device group
c) A Custom Application Behavior rule set
d) A shared App Control rule set

05. A cloud-managed device group already has an Antimalware policy. The administrator wants a second, stricter Antimalware policy to apply to the same group only when certain users are signed in.
How is this achieved in SES?
a) Add both Antimalware policies to one policy group and apply the policy group
b) Apply the second policy with a policy target rule naming those users as its condition
c) Disable inheritance on the group first, then apply the second policy directly
d) Upgrade both policies to the newest template revision so that they can coexist

06. An endpoint is beaconing to an external host. The malicious process has not yet been identified, and the team wants the endpoint contained at the network level while investigation continues.
Which response action fits?
a) Quarantine Device
b) Deny File
c) Quarantine File
d) Submit to Sandbox

07. After several edits to an applied Firewall policy, an administrator needs to see each saved version together with who modified it and when.
Where is this information shown?
a) The policy's Comments tab
b) The policy's Versions tab
c) The Hierarchy View on the Device Groups tab
d) The device's Command History tab

08. A downloaded application passes its pre-execution checks and launches normally. Only after it starts running does it begin acting maliciously.
Which Antimalware technology provides the real-time protection that detects it while it runs?
a) Advanced machine learning
b) Download Insight
c) Early launch antimalware
d) Behavioral Analysis

09. An untrusted application that is allowed to run on Windows devices has started modifying files in a local finance data folder, a pattern seen before ransomware encryption.
Which configuration protects those files from the application's activity?
a) Adaptive Isolation set to Monitor Only
b) A Custom Application Behavior rule set in MONITOR status
c) Adaptive Isolation set to Isolate and Monitor
d) A Device Control rule that blocks removable storage

10. A hybrid customer is ready to move one SEPM group's Windows clients to full cloud management.
Which action does the documentation prescribe?
a) Run Switch Group to Cloud Managed
b) Migrate the SEPM database to the cloud
c) Use Move to Environment
d) Enable Manage Policies from the Cloud