Most Recent Broadcom 250-580 Exam Questions & Answers

Living off the land (LOTL) is a tactic where adversaries leverage existing tools and resources within the environment for malicious purposes. This approach minimizes the need to introduce new, detectable malware, instead using trusted system utilities and software already present on the network.

Characteristics of Living off the Land:

LOTL attacks make use of built-in utilities, such as PowerShell or Windows Management Instrumentation (WMI), to conduct malicious operations without triggering traditional malware defenses.

This method is stealthy and often bypasses signature-based detection, as the tools used are legitimate components of the operating system.

Why Other Options Are Incorrect:

Opportunistic attack (Option A) refers to attacks that exploit easily accessible vulnerabilities rather than using internal resources.

File-less attack (Option B) is a broader category that includes but is not limited to LOTL techniques.

Script kiddies (Option C) describes inexperienced attackers who use pre-made scripts rather than sophisticated, environment-specific tactics.

To identify computers that need a restart for completing threat remediation, the administrator should:

Steps for Identification and Action:

View the Computer Status log in the Symantec Endpoint Protection Manager (SEPM) to see if any computers are flagged as needing a restart.

Once identified, the administrator can go to the Risk log and run a command to initiate a restart on those systems, thereby completing the remediation process.

Why This Method is Effective:

The Computer Status log provides comprehensive information on the current state of each endpoint, including whether a restart is pending.

Risk log commands enable administrators to remotely trigger actions such as reboots on endpoints impacted by malware.

Why Other Options Are Incorrect:

Other options suggest using logs like SONAR or Attack logs to trigger restarts, which do not provide the necessary functionality for identifying and restarting systems in need of final remediation.

When creating a block list entry in Symantec Endpoint Detection and Response (SEDR), the SHA256 hash is a valid file attribute. SHA256 uniquely identifies files based on their content, making it a reliable attribute for ensuring that specific files, regardless of their names or creation dates, are accurately blocked. This hashing method helps prevent identified malicious files from executing, regardless of their locations or renaming attempts by attackers.

The Security Analyst Role in Symantec Endpoint Protection has permissions to search endpoints, trigger dumps, and get & quarantine files. These permissions allow security analysts to investigate potential threats, gather data for further analysis, and isolate malicious files as needed.

Capabilities of the Security Analyst Role:

Search Endpoints: Analysts can perform searches across endpoints to locate suspicious files or artifacts.

Trigger Dumps: This allows analysts to create memory dumps or other forensic data for in-depth investigation.

Get & Quarantine Files: Analysts can quarantine files directly from endpoints, thereby mitigating threats and preventing further spread.

Why Other Options Are Incorrect:

Enrolling new sites (Option A) and creating device groups or policies (Options C and D) are typically reserved for administrators with broader access rights rather than for security analysts.

To temporarily or permanently block a file, the administrator should use the Deny List option. Adding a file to the Deny List prevents it from executing or being accessed on the system, providing a straightforward way to block suspicious or unwanted files.

Functionality of Deny List:

Files on the Deny List are effectively blocked from running, which can be applied either temporarily or permanently depending on security requirements.

This list allows administrators to manage potentially malicious files by preventing them from executing across endpoints.

Why Other Options Are Not Suitable:

Delete (Option A) is a one-time action and does not prevent future attempts to reintroduce the file.

Hide (Option B) conceals files but does not restrict access.

Encrypt (Option C) secures the file's data but does not prevent access or execution.