I85PREP
⌘ K
ETMD EP Practitioners study materials
ETMD EP Practitioners study resources

ETMD EP Practitioners practice questions

One question at a time. Build your ETMD EP Practitioners understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Endpoint Security Fundamentals and Threat Landscape

In endpoint protection terminology, what distinguishes a fileless malware attack from a conventional executable-based infection?

  1. It requires a signed kernel driver to be installed before any code can execute.
  2. It spreads exclusively through removable USB media formatted with the FAT32 file system.
  3. It always encrypts user documents and demands payment before any detection can occur.
  4. It runs in memory or abuses trusted system tools and scripts, leaving little or no malicious binary on disk. Correct answer.

Explanation

Fileless techniques execute in memory or leverage living-off-the-land binaries such as PowerShell, WMI, or mshta, so the malicious payload never needs to be written as an executable file. This makes signature scanning of files on disk far less effective and shifts detection toward behavior and script telemetry.

Question 2Endpoint Security Fundamentals and Threat Landscape

Which endpoint telemetry source most directly reveals a process injecting code into another process's address space?

  1. Windows event log entries for user logon events
  2. EDR process and memory events recording remote thread creation across processes Correct answer.
  3. Periodic full-disk antivirus scans
  4. NetFlow records exported from the perimeter router

Explanation

Process injection manifests as cross-process operations such as remote thread creation, memory allocation in a foreign process, and handle acquisition. EDR sensors that hook process and memory activity capture these relationships, whereas the other sources lack that granularity.

Question 3Endpoint Security Fundamentals and Threat Landscape

An analyst sees a document that asks the user to enable macros before displaying its content. Which threat is this pattern most characteristic of?

  1. A malicious macro dropper that executes a script when the user enables content Correct answer.
  2. A denial-of-service flood targeting an internet-facing web server
  3. A supply chain compromise of a software update server
  4. A phishing email that only contains a link to a credential-harvesting page

Explanation

Social engineering that pressures a user into enabling macros is a classic delivery method for script-based droppers embedded in office documents. Once macros run, they typically fetch or launch a second-stage payload.

Question 4Endpoint Security Fundamentals and Threat Landscape

Which description best matches a living-off-the-land binary (LOLBin) abuse scenario?

  1. An attacker exploits a buffer overflow in a third-party media player.
  2. An attacker uses a signed, legitimately installed system utility to download or execute payloads. Correct answer.
  3. An attacker installs a custom rootkit that hides its files from the operating system.
  4. An attacker brute-forces RDP credentials against an exposed server.

Explanation

LOLBin abuse repurposes trusted, signed operating system utilities such as certutil, regsvr32, or rundll32 to perform malicious actions while blending into normal administrative activity. Because the binaries are legitimate, allowlisting by file reputation alone will not stop them.

Question 5Endpoint Security Fundamentals and Threat Landscape

What is the primary defensive purpose of application allowlisting on an endpoint?

  1. To encrypt endpoint disks so stolen laptops cannot be read
  2. To detect known malicious file hashes by comparing them with a cloud reputation database
  3. To throttle outbound bandwidth used by peer-to-peer applications
  4. To block execution of any binary that is not on an approved inventory, regardless of whether it is malicious Correct answer.

Explanation

Allowlisting inverts the traditional model by permitting only explicitly approved executables and blocking everything else, which stops both known and never-before-seen payloads. It is preventive rather than detective, so it complements signature-based scanning.

Question 6Endpoint Security Fundamentals and Threat Landscape

Which attack technique is specifically designed to bypass endpoint detection by running malicious code inside a trusted, already-running process?

  1. DNS tunneling over port 53 to an external resolver
  2. Physical theft of an unencrypted laptop
  3. Process hollowing and injection into a legitimate host process Correct answer.
  4. Password spraying against a cloud identity provider

Explanation

Process hollowing and injection place attacker code inside a trusted process so that activity appears to originate from a legitimate image. This defeats naive parent-child and image-path heuristics unless memory and cross-process behavior are monitored.

Question 7Endpoint Security Fundamentals and Threat Landscape

Which endpoint control most directly limits the damage a compromised user account can cause through lateral movement?

  1. Disabling the endpoint firewall on the internal network segment
  2. Enforcing least privilege and removing local administrator rights from standard users Correct answer.
  3. Using the same local administrator password across all workstations
  4. Relying solely on monthly signature updates for the antivirus engine

Explanation

Removing unnecessary administrative rights limits what a compromised account can do locally and constrains credential theft and lateral movement. Most lateral movement techniques depend on privileged credentials being available on the host.

Question 8Endpoint Security Fundamentals and Threat Landscape

What does a behavioral detection engine evaluate that a static hash-based engine cannot?

  1. The sequence of actions a process performs at runtime, such as registry writes and child process creation Correct answer.
  2. The cryptographic digest of a file before it is executed
  3. The file extension of an email attachment
  4. The certificate chain used to sign a driver package

Explanation

Behavioral engines observe runtime action sequences and score them against malicious patterns, allowing them to catch polymorphic or novel samples whose hashes are unknown. Hash-based engines can only match files already known and catalogued.

Question 9Endpoint Security Fundamentals and Threat Landscape

An endpoint alerts on rundll32.exe spawning from an Excel process and making an outbound HTTPS connection to a newly registered domain. Which interpretation is most defensible?

  1. This indicates the endpoint's antivirus signatures are out of date.
  2. This suggests a malicious macro executed rundll32 to load a payload and beacon out. Correct answer.
  3. This is normal behavior because rundll32 is a signed Microsoft binary.
  4. This proves the user downloaded a legitimate Excel add-in from the vendor.

Explanation

Office applications do not normally spawn rundll32 with network egress, so the parent-child relationship plus a fresh external domain is a strong indicator of macro-based execution and command-and-control. The signed nature of rundll32 is exactly why attackers choose it.

Question 10Endpoint Security Fundamentals and Threat Landscape

Which characteristic most strongly indicates that an observed binary is a ransomware precursor rather than the encryption stage itself?

  1. A user opening a PDF attachment from a known sender
  2. A scheduled task that runs a signed backup agent nightly
  3. A single outbound DNS query to a public resolver
  4. Rapid enumeration of file shares and deletion of volume shadow copies before any file encryption Correct answer.

Explanation

Ransomware operators commonly perform discovery of accessible shares and destroy shadow copies or backups before encrypting, so these actions are reliable precursors. Detecting them provides an opportunity to contain the host before data is lost.

Question 11Endpoint Security Fundamentals and Threat Landscape

A workstation begins contacting its command-and-control server every 60 seconds with small, fixed-size HTTPS beacons. Which detection approach is best suited to identify this pattern?

  1. Reviewing local group membership changes
  2. Analyzing network flow periodicity and payload size consistency over time Correct answer.
  3. Scanning the registry for unauthorized autostart entries
  4. Comparing file hashes against a threat intelligence feed

Explanation

Regular beaconing produces a distinctive timing and size pattern that flow analysis can surface even when the traffic is encrypted. Hash comparison and host configuration checks do not examine the temporal network behavior.

Question 12Endpoint Security Fundamentals and Threat Landscape

An attacker uses certutil.exe with the -urlcache flag to retrieve a remote file. Why does this technique often evade naive allowlisting?

  1. certutil.exe disables the endpoint firewall before downloading
  2. certutil.exe modifies the master boot record to hide the download
  3. certutil.exe is a signed built-in utility that is already on the approved software list Correct answer.
  4. certutil.exe encrypts the file so signature scanners cannot read it

Explanation

Because certutil is a legitimate signed Windows tool, path- or hash-based allowlists typically permit it, and the download appears as trusted utility activity. Defenders must add command-line argument monitoring and script-block logging to catch the abuse.

Question 13Endpoint Security Fundamentals and Threat Landscape

Which endpoint hardening measure most effectively reduces the impact of a malicious macro in an Office document?

  1. Blocking macros from the internet and enforcing signed-macro-only policy Correct answer.
  2. Increasing the screen lock timeout to 30 minutes
  3. Allowing users to install browser extensions freely
  4. Enabling guest access on the file server

Explanation

Blocking macros in files obtained from the internet and requiring trusted signatures removes the execution path most macro droppers depend on. The other options either weaken controls or are unrelated to macro execution.

Question 14Endpoint Security Fundamentals and Threat Landscape

During triage, an analyst finds a process whose image path is C:\Windows\System32\svchost.exe but whose parent is explorer.exe. What is the most reasonable next step?

  1. Dismiss the alert because svchost.exe is a core Windows binary
  2. Conclude the user launched a legitimate service manually
  3. Treat it as suspicious and examine command line, loaded modules, and network connections Correct answer.
  4. Immediately reimage the machine without collecting evidence

Explanation

Genuine svchost instances are launched by services.exe, so an explorer.exe parent suggests process masquerading or injection. Analysts should gather command-line, module, and network context before deciding on containment.

Question 15Endpoint Security Fundamentals and Threat Landscape

Which control best mitigates credential dumping tools that read the LSASS process memory?

  1. Disabling Windows Defender Firewall domain profile
  2. Granting all users debug privilege for troubleshooting
  3. Enabling LSASS protection such as Credential Guard or RunAsPPL Correct answer.
  4. Storing plaintext passwords in a shared spreadsheet

Explanation

LSASS protection measures restrict access to process memory so dumping tools cannot read cached credentials. This directly addresses the technique rather than merely detecting it afterward.

Question 16Endpoint Security Fundamentals and Threat Landscape

An EDR alert shows a script interpreter launching PowerShell with an encoded command and the -nop and -w hidden flags. Which conclusion is best supported?

  1. The activity is benign because PowerShell ships with Windows
  2. The host is definitely infected with ransomware that has begun encrypting files
  3. The user must have mistyped a legitimate administrative command
  4. The combination of encoded content, hidden window, and no profile strongly suggests obfuscated malicious execution Correct answer.

Explanation

Encoded commands combined with hidden-window and no-profile flags are hallmarks of obfuscated execution intended to evade logging and user notice. It indicates suspicious script execution but does not by itself confirm a specific payload such as ransomware.

Question 17Endpoint Security Fundamentals and Threat Landscape

What is the defensive value of collecting parent-child process relationships in EDR telemetry?

  1. It replaces the need for network monitoring entirely
  2. It reveals whether an application spawned unexpected children, exposing execution chains used by droppers Correct answer.
  3. It encrypts process memory to prevent injection
  4. It guarantees that no malicious file can ever execute on the host

Explanation

Process lineage shows how execution flows from a user-facing application to child processes, which is how macro droppers and script launchers are exposed. It is a detection signal, not a preventive guarantee.

Question 18Endpoint Security Fundamentals and Threat Landscape

Which scenario most clearly represents a supply chain attack against an endpoint?

  1. An attacker guesses a weak password on an SSH service
  2. A malicious insider copies files to a USB drive
  3. A user clicks a link in a spam email and enters credentials on a fake page
  4. A trusted software vendor's update mechanism delivers a trojanized installer to customers Correct answer.

Explanation

Supply chain compromise subverts a trusted distribution channel so that victims install malicious code believing it is legitimate. Trust in the vendor is what allows the payload to reach many endpoints at once.

Question 19Endpoint Security Fundamentals and Threat Landscape

An attacker drops a signed vulnerable driver and uses it to terminate protected security processes. Which threat category does this describe?

  1. Watering hole website compromise
  2. Kerberoasting of service accounts
  3. Bring-your-own-vulnerable-driver attack Correct answer.
  4. Domain fronting over CDN infrastructure

Explanation

Bring-your-own-vulnerable-driver attacks load a legitimately signed but flawed kernel driver to gain kernel-level capability and disable protections. Because the driver is signed, signature trust alone will not block it.

Question 20Endpoint Security Fundamentals and Threat Landscape

Which indicator is most consistent with a persistence mechanism on a Windows endpoint?

  1. A newly created scheduled task that runs a user-writable script at every logon Correct answer.
  2. An increase in CPU usage during a video call
  3. A one-time DNS lookup of a popular search engine
  4. A temporary file created during a software install

Explanation

Persistence requires a mechanism that re-executes attacker code across reboots or logons, and a scheduled task pointing at a user-writable script is a common example. Analysts should baseline legitimate tasks and review new or modified entries.

Question 21Endpoint Security Fundamentals and Threat Landscape

Which combination of endpoint signals best supports a high-confidence determination that a host is beaconing to attacker infrastructure?

  1. A user logging in at the start of the workday and a scheduled backup completing
  2. A browser update and a reboot event in the system log
  3. Repeated connections at regular intervals to a low-reputation domain, plus a matching suspicious parent process Correct answer.
  4. A single antivirus signature update and a routine software inventory scan

Explanation

High-confidence beaconing determinations combine temporal network regularity toward a low-reputation destination with corroborating host context such as a suspicious parent process. Correlating independent signals reduces false positives from benign periodic traffic.

Question 22Endpoint Security Fundamentals and Threat Landscape

An analyst observes that a malicious sample's hash changes on every execution but its runtime behavior remains identical. Which detection strategy remains most effective?

  1. Behavioral rules that match the consistent runtime action sequence Correct answer.
  2. Disabling script logging to reduce alert volume
  3. Blocklisting each newly observed hash as it appears
  4. Relying on file name matching against a known malware list

Explanation

Polymorphic samples alter their bytes and hashes while preserving the same behavioral pattern, so behavior-based rules remain effective where hash blocklists are always one step behind. This is why runtime monitoring complements static indicators.

Question 23Endpoint Security Fundamentals and Threat Landscape

A security team wants to reduce the risk of Kerberoasting on endpoints and servers. Which measure addresses the root cause most directly?

  1. Replacing weak service account passwords with long, randomly generated managed service accounts Correct answer.
  2. Enabling verbose audit logging without changing account configuration
  3. Requiring users to change their desktop wallpaper quarterly
  4. Blocking outbound SMB traffic at the perimeter only

Explanation

Kerberoasting succeeds by requesting service tickets and cracking them offline, so the practical defense is making the encrypted material infeasible to crack through long, random, rotated service account secrets. Managed service accounts automate that rotation.

Question 24Endpoint Security Fundamentals and Threat Landscape

An EDR alert fires because a process opened a handle to lsass.exe with read permissions, and the process image resides in a user's temp directory. Which assessment is most accurate?

  1. This is expected behavior for any application that uses Windows authentication
  2. This is a strong credential-dumping indicator requiring immediate investigation and possible isolation Correct answer.
  3. This confirms the host is participating in a denial-of-service attack
  4. This indicates the endpoint's disk is failing and should be replaced

Explanation

Reading LSASS memory from an unsigned binary in a temp directory matches the credential dumping pattern used by tools such as Mimikatz. Immediate triage and containment are warranted because stolen credentials enable lateral movement.

Question 25Endpoint Security Fundamentals and Threat Landscape

An attacker uses a signed installer from a legitimate vendor to sideload a malicious DLL placed in the application directory. Why does this evade many application control policies?

  1. The signed executable is trusted, and the policy may not validate every DLL loaded from the application folder Correct answer.
  2. The installer disables the operating system's code integrity checks during setup
  3. The policy engine ignores all files smaller than one megabyte
  4. The malicious DLL is always stored in the kernel address space

Explanation

DLL search order sideloading exploits trust in the signed host executable while the malicious library is loaded from a writable directory. Policies that validate only the primary executable, and not loaded modules, will miss it.

Question 26Endpoint Security Fundamentals and Threat Landscape

Which term describes malicious software that disguises itself as legitimate or useful software to trick users into installing it, while carrying out harmful activity in the background?

  1. Trojan Correct answer.
  2. Rootkit
  3. Adware
  4. Worm

Explanation

A Trojan is malware that presents itself as legitimate software to persuade a user to run it, then performs hidden malicious actions. Unlike a worm, it does not self-propagate, and unlike a rootkit, its defining trait is deception rather than stealth at the kernel level.

Question 27Endpoint Security Fundamentals and Threat Landscape

Which phase of the Cyber Kill Chain describes an adversary using a malicious attachment or exploit to deliver a payload onto an endpoint?

  1. Weaponization
  2. Installation
  3. Reconnaissance
  4. Delivery Correct answer.

Explanation

Delivery is the phase in which the adversary transmits the weaponized payload to the target environment, for example through a phishing email attachment or a malicious link. Weaponization occurs earlier when the payload is paired with an exploit, and installation occurs after the payload has been executed and established on the host.

Question 28Endpoint Security Fundamentals and Threat Landscape

An analyst reviewing endpoint telemetry sees a process named chrome.exe with an image path of C:\Users\Public\chrome.exe and a parent process of cmd.exe. Which conclusion is most defensible?

  1. The process is benign because cmd.exe is a trusted Windows component.
  2. The process is legitimate because the name matches a known browser.
  3. The process is suspicious because its path and parent are inconsistent with a normal browser launch. Correct answer.
  4. The process is a confirmed ransomware infection because it runs from a public folder.

Explanation

Legitimate browsers normally reside under Program Files and are launched by explorer.exe or a browser updater, not from a world-writable public directory by cmd.exe. The combination of an unusual image path and an interactive shell parent is a strong masquerading indicator that warrants investigation. Neither the filename nor the parent alone proves maliciousness, but together they justify escalation.

Question 29Endpoint Security Fundamentals and Threat Landscape

Which endpoint security control is designed to block the execution of previously unseen malware by enforcing an allowlist of approved applications?

  1. Host-based firewall
  2. Full-disk encryption
  3. Signature-based antivirus
  4. Application allowlisting Correct answer.

Explanation

Application allowlisting permits only explicitly approved executables to run, so unknown or novel binaries are blocked regardless of whether a signature exists. Signature-based antivirus depends on known patterns, while firewalls and disk encryption address network access and data-at-rest confidentiality respectively.

Question 30Endpoint Security Fundamentals and Threat Landscape

An attacker uses a signed, legitimate remote monitoring and management (RMM) tool already approved in the environment to execute commands and move laterally. Which detection strategy is most likely to surface this activity?

  1. Relying on the tool's digital signature as proof of legitimacy.
  2. Blocking all RMM binaries by hash at the endpoint.
  3. Alerting on unusual RMM command patterns, parent processes, and destination infrastructure. Correct answer.
  4. Disabling PowerShell logging to reduce noise from the RMM agent.

Explanation

Living-off-the-land abuse of trusted tools bypasses signature and hash controls, so detection must focus on behavioral context such as atypical command lines, unexpected parent processes, and connections to unfamiliar infrastructure. Treating a valid signature as proof of benign intent ignores the possibility that a legitimate tool is being misused. Reducing telemetry would further degrade visibility.

Question 31Endpoint Protection Platform Deployment and Configuration

In a Trellix ePolicy Orchestrator deployment, which server component is responsible for storing the system tree, policies, and event data used by managed endpoints?

  1. The agent handler
  2. The endpoint sensor
  3. The ePO database Correct answer.
  4. The distributed repository

Explanation

The ePO database is the central data store holding the system tree, policy assignments, agent handlers, and event records that the ePO server reads and writes. Agent handlers and repositories are stateless distribution roles, and the sensor runs on the endpoint, so none of them persist configuration data.

Question 32Endpoint Protection Platform Deployment and Configuration

Which ePO feature lets an administrator automatically place newly discovered endpoints into the correct group based on criteria such as IP range or operating system?

  1. Policy inheritance
  2. Automatic sorting Correct answer.
  3. Repository replication
  4. Agent wake-up call

Explanation

Automatic sorting applies administrator-defined criteria, such as subnet or OS, to route a newly checked-in system into the appropriate system tree group. Policy inheritance and wake-up calls act after placement and do not perform assignment.

Question 33Endpoint Protection Platform Deployment and Configuration

An administrator wants endpoints to receive updated DAT content without each endpoint contacting the internet. Which configuration accomplishes this?

  1. Configure each endpoint with a direct internet proxy
  2. Point agents to a distributed repository that pulls content from the source site Correct answer.
  3. Disable automatic updates and rely on manual DAT imports
  4. Enable only agent wake-up calls on a schedule

Explanation

A distributed repository (or SuperAgent) downloads content from the source repository and serves it to agents on the local network, removing direct internet dependency. Manual imports and per-endpoint proxies do not scale, and wake-up calls only trigger check-ins.

Question 34Endpoint Protection Platform Deployment and Configuration

Which policy type in ePO controls settings such as on-access scanning behavior for VirusScan Enterprise or Endpoint Security Threat Prevention?

  1. Agent policy
  2. Repository policy
  3. System tree policy
  4. Threat Prevention policy Correct answer.

Explanation

Threat Prevention policies carry the scanning, exclusions, and on-access settings that the endpoint security module enforces. Agent policies govern check-in and communication behavior, while repository and system tree settings are infrastructure concerns.

Question 35Endpoint Protection Platform Deployment and Configuration

A security team must ensure a critical policy change reaches all endpoints within one hour regardless of the normal check-in interval. Which action best achieves this?

  1. Shorten the DAT update schedule
  2. Change the automatic sorting criteria
  3. Increase the repository replication interval
  4. Issue an agent wake-up call to the affected groups Correct answer.

Explanation

An agent wake-up call prompts agents to check in immediately so they pull the new policy without waiting for the scheduled interval. Replication, sorting, and DAT schedules affect content and placement rather than policy delivery timing.

Question 36Endpoint Protection Platform Deployment and Configuration

Which ePO role assignment allows a help-desk technician to view the system tree and run queries without changing policies?

  1. Repository manager rights
  2. Full administrator rights on the root group
  3. Agent handler operator rights
  4. A read-only permission set scoped to the relevant groups Correct answer.

Explanation

Least-privilege accounts should receive read-only permissions limited to the groups they support, which permits viewing and querying without policy modification. Full administrator and infrastructure roles grant far more access than the task requires.

Question 37Endpoint Protection Platform Deployment and Configuration

What is the primary purpose of the ePO system tree?

  1. To organize managed systems into groups that inherit policies and tasks Correct answer.
  2. To host the installer packages downloaded by agents
  3. To record administrator login history
  4. To store quarantined files from endpoints

Explanation

The system tree is the hierarchical grouping structure through which policies, tasks, and client assignments are inherited by managed systems. Quarantine storage, package hosting, and audit logging are handled by other components.

Question 38Endpoint Protection Platform Deployment and Configuration

An administrator is deploying the endpoint agent to a large group of workstations using a logon script. Which deployment method does this describe?

  1. Repository-based pull deployment
  2. ePO agent handler deployment
  3. Script-based push deployment Correct answer.
  4. Manual installation from removable media

Explanation

Script-based deployment uses logon scripts or similar automation to install the agent on workstations as users authenticate. Manual media and repository pull methods rely on different distribution mechanics.

Question 39Endpoint Protection Platform Deployment and Configuration

Which consideration is most important when planning agent handler placement in a large, multi-site environment?

  1. Placing handlers near the endpoints they serve to reduce WAN traffic Correct answer.
  2. Hosting handlers only on domain controllers
  3. Disabling handler failover to avoid duplicate events
  4. Assigning all endpoints to a single handler for simplicity

Explanation

Agent handlers should be distributed close to the endpoints they support so check-ins and content requests avoid crossing slow WAN links. Consolidating on one handler creates a bottleneck and single point of failure, and domain controllers are poor handler hosts.

Question 40Endpoint Protection Platform Deployment and Configuration

Which setting determines how frequently a managed agent contacts its ePO server for policy and task updates?

  1. The DAT update interval
  2. The on-access scan timeout
  3. The repository replication schedule
  4. The agent check-in interval Correct answer.

Explanation

The agent check-in interval in the agent policy defines how often the agent communicates with ePO to retrieve policy and task changes. DAT intervals, scan timeouts, and replication schedules govern other independent functions.

Question 41Endpoint Protection Platform Deployment and Configuration

A team wants endpoints in a high-security group to use stricter scanning than the rest of the organization while still receiving baseline settings. How should policies be structured?

  1. Apply the stricter policy at the root so all systems inherit it
  2. Assign the stricter policy directly to individual endpoints only
  3. Delete the baseline policy from the parent group
  4. Break inheritance on the high-security group and enforce the stricter policy there Correct answer.

Explanation

Breaking inheritance at the high-security group lets it override specific settings while still receiving other baseline configuration from parents. Applying strict settings at root or deleting the baseline would affect or remove protection for unrelated systems.

Question 42Endpoint Protection Platform Deployment and Configuration

Which ePO component collects and stores events forwarded from managed endpoints for reporting and dashboards?

  1. The agent handler cache
  2. The automatic sorting engine
  3. The ePO event database and server reporting services Correct answer.
  4. The distributed repository

Explanation

Events flow from agents to the ePO server, which stores them in the database and exposes them through queries, dashboards, and reports. Repositories, handler caches, and sorting do not persist event data for reporting.

Question 43Endpoint Protection Platform Deployment and Configuration

During a pilot, an administrator needs to verify that a newly deployed agent is communicating with ePO. Which indicator confirms successful communication?

  1. The agent handler service reports a stopped state
  2. The endpoint appears in the repository list
  3. The DAT version is older than the source site
  4. The system shows a recent last-communication time in the system tree Correct answer.

Explanation

A recent last-communication timestamp in the system tree confirms the agent is checking in and exchanging data with ePO. Repository listings, handler service states, and DAT age do not directly prove agent-server communication.

Question 44Endpoint Protection Platform Deployment and Configuration

Which ePO task type would an administrator schedule to run a full on-demand scan on endpoints every weekend?

  1. A repository replication task
  2. A client task assigned to the relevant system tree groups Correct answer.
  3. A server database backup task
  4. An agent handler maintenance task

Explanation

Client tasks are assigned through the system tree and execute on managed endpoints on the defined schedule, making them the correct mechanism for scheduled on-demand scans. Handler, replication, and backup tasks run on infrastructure, not endpoints.

Question 45Endpoint Protection Platform Deployment and Configuration

What is the purpose of a SuperAgent in an ePO deployment?

  1. To act as a local content and policy relay for peer endpoints Correct answer.
  2. To host the ePO server console
  3. To replace the ePO database in small environments
  4. To perform automatic sorting of new systems

Explanation

A SuperAgent is an endpoint configured to distribute content and relay updates to peer agents, reducing bandwidth and server load. It does not replace the database, perform sorting, or host the console.

Question 46Endpoint Protection Platform Deployment and Configuration

An administrator must ensure agents can still obtain content if the primary repository is unavailable. Which configuration provides this resilience?

  1. Configure a fallback repository in the agent policy Correct answer.
  2. Assign all agents to a single repository
  3. Increase the check-in interval
  4. Disable repository replication

Explanation

Specifying a fallback repository lets agents retrieve content from an alternate source when the primary is unreachable. Longer check-in intervals, disabled replication, and single-repository assignment all reduce resilience.

Question 47Endpoint Protection Platform Deployment and Configuration

Which deployment method uses the operating system's remote management capability to install the agent on Windows hosts without user interaction?

  1. Manual media installation
  2. Logon script deployment
  3. Push deployment through remote installation Correct answer.
  4. Repository pull deployment

Explanation

Remote push deployment leverages OS remote management services to install the agent on target hosts without local user action. Scripts, media, and pull methods rely on different triggers and mechanics.

Question 48Endpoint Protection Platform Deployment and Configuration

An administrator notices that a group of endpoints is not receiving a recently changed policy. The group's policy assignment shows inheritance broken at a parent level. What is the most likely cause?

  1. The DAT update interval is too short
  2. A child group has broken inheritance and retains an older assigned policy Correct answer.
  3. The repository replication schedule is too long
  4. Automatic sorting placed the systems in the wrong group

Explanation

When a child group breaks inheritance, it stops receiving parent policy changes and keeps its own assigned policy, which explains why the new setting never arrives. Replication, DAT timing, and sorting affect content and placement rather than inherited policy propagation.

Question 49Endpoint Protection Platform Deployment and Configuration

Which ePO permission best limits an auditor to reviewing policy compliance reports without altering configuration?

  1. Full administrator on the root group
  2. Agent handler management rights
  3. Policy edit rights on all groups
  4. A report-viewing permission set without policy edit rights Correct answer.

Explanation

Auditors need read access to reports and queries but should not hold edit or administrative rights. Full administrator, policy edit, and handler management permissions all exceed the review-only requirement.

Question 50Endpoint Protection Platform Deployment and Configuration

What does the ePO server use to authenticate a managed agent during check-in?

  1. The user's domain password
  2. A unique agent GUID and shared keys established at deployment Correct answer.
  3. The DAT version string
  4. The endpoint's MAC address alone

Explanation

Agents are identified by a unique GUID and authenticated using keys established during agent installation and handler registration. MAC addresses, user passwords, and content version strings are not used as agent credentials.