250-604 by Broadcom Valid Free Exam Practice Test

Question 1

Which policy feature can assist in tracking changes over time and debugging misconfigurations?

A. Policy version history B. Logging level adjustment C. Content sync monitoring D. Endpoint tagging

Correct Answer: A

Question 2

Which features are integral to SES Complete's endpoint agent functionality? (Choose two)

A. Log shipping to Azure only B. Local database backup C. Real-time telemetry reporting D. Command and control detection

Correct Answer: C,D

Question 3

Scenario:
Your organization is expanding to new geographies, and you are tasked with applying attack surface reduction through SES Complete's App Control. Several regional apps trigger frequent alerts due to behavior deemed uncommon.
Which two strategies should you implement to ensure operational continuity while maintaining security posture? (Choose two)

A. Add regional apps to a whitelist based on drift analysis B. Disable application behavior logging temporarily C. Increase enforcement mode to block all unverified apps D. Use heatmap data to determine behavior acceptability

Correct Answer: A,D

Question 4

Which situation would justify enabling LiveShell for a particular endpoint within EDR?

A. The endpoint requires reboot B. A threat was found that requires live command-line investigation C. The endpoint must be moved to a guest network D. The endpoint is being reformatted

Correct Answer: B

Question 5

Why is the use of real-time analysis critical in the context of Threat Defense for Active Directory's protection strategy?

A. Because it provides an instant shutdown command for all elevated user accounts B. Because it reduces latency in email spam filtering by redirecting logs C. Because it correlates backup schedules with login timestamps for user integrity D. Because it enables immediate visibility into suspicious AD activity that could indicate an ongoing attack

Correct Answer: D

Question 6

Which two features of the ICDm Dashboard help identify and prioritize critical threats in real time? (Choose two)

A. Security Control Widgets B. Administrative Role Manager C. Threat Timeline Heatmap D. LiveShell Scripting Console

Correct Answer: A,C

Question 7

What is the primary role of LiveShell within the EDR framework in ICDm?

A. Initiating real-time command-line investigation on remote devices B. Updating policy changes across isolated endpoints C. Patching vulnerabilities in endpoint firmware D. Automating system restarts after malware cleanup

Correct Answer: A

Question 8

Which monitoring techniques are used by Threat Defense for Active Directory to identify potentially malicious behaviors in AD environments? (Choose two)

A. Analyzing Group Policy inheritance across domain trees B. Monitoring failed login attempts and abnormal authentication requests C. Observing abnormal access to administrative shares and sensitive AD objects D. Tracking PowerShell command logs and matching them against whitelisted scripts

Correct Answer: B,C

Question 9

How can EDR assist security administrators in distinguishing between suspicious and confirmed malicious activity?

A. By issuing licensing alerts for underused devices B. By comparing behaviors against predefined threat intelligence baselines C. By modifying user roles and access rights D. By auto-deploying new agents across endpoints

Correct Answer: B

Question 10

What kind of threat activities can be effectively identified through the use of Threat Defense for Active Directory?

A. Bluetooth sniffing attacks across user devices B. Code obfuscation in signed .NET libraries C. Kerberoasting, brute force login attempts, and privilege escalation techniques D. In-memory exploitation of Java processes

Correct Answer: C

Question 11

Which component of ICDm allows administrators to initiate remediation actions such as isolating an endpoint or deleting a malicious file?

A. Device Inventory B. Asset Management Console C. Alert Management Dashboard D. Incident Response Actions Panel

Correct Answer: D

Question 12

Scenario:
Your enterprise supports a BYOD (Bring Your Own Device) policy. Security reports show a growing number of incidents involving mobile apps that access corporate resources and send data to unknown destinations.
Which two SES Complete features should you prioritize to address this issue? (Choose two)

A. Enable Network Integrity policies to monitor network behavior B. Scan mobile apps using behavioral threat detection C. Disable cellular access via ICDm policy D. Deploy device fingerprinting for OS patch verification

Correct Answer: A,B

Question 13

What methods does SES Complete use to prevent threat persistence? (Choose two)

A. Restricting autorun configurations B. Removing obsolete drivers C. Blocking registry modifications D. Updating antivirus signatures

Correct Answer: A,C

Question 14

Scenario:
A large enterprise is piloting SES Complete's hybrid configuration in a subset of regional offices. The security team reports successful communication between SEPM and ICDm but needs guidance on managing endpoint policies during the pilot phase.
Which two recommendations would best support this deployment? (Choose two)

A. Migrate all users immediately to ICDm-managed policies B. Segment pilot users into dedicated groups in both SEPM and ICDm C. Apply ICDm policies in monitor-only mode initially D. Remove SEPM site replication settings

Correct Answer: B,C

Question 15

What happens when SES Complete detects defense evasion activity?

A. The system logs out the user B. Policy-defined action such as alert, block, or isolate is triggered C. The endpoint is auto-quarantined D. Internet access is permanently disabled

Correct Answer: B

Broadcom Symantec Endpoint Security Complete Admin R1.4 Technical Specialist - 250-604 Exam Practice Test