I85PREP
⌘ K
SNAP study materials
SNAP study resources

SNAP practice questions

One question at a time. Build your SNAP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security Fundamentals

In the TCP/IP model, which layer is responsible for logical addressing and routing of packets between networks?

  1. Application layer
  2. Network access layer
  3. Internet layer Correct answer.
  4. Transport layer

Explanation

The Internet layer of the TCP/IP model handles logical addressing (IP addresses) and routing, deciding how packets travel between networks. The transport layer manages end-to-end delivery and ports, while the network access layer covers physical and data-link concerns.

Question 2Network Security Fundamentals

Which protocol operates at the transport layer and provides reliable, connection-oriented delivery with acknowledgments?

  1. UDP
  2. ICMP
  3. TCP Correct answer.
  4. ARP

Explanation

TCP is the connection-oriented transport protocol that establishes a session, sequences segments, and uses acknowledgments and retransmissions to provide reliable delivery. UDP is connectionless, while ICMP and ARP operate at other layers.

Question 3Network Security Fundamentals

A workstation needs the MAC address associated with a known IPv4 address on the local subnet. Which protocol resolves this?

  1. SNMP
  2. ARP Correct answer.
  3. DHCP
  4. DNS

Explanation

ARP broadcasts a request asking which device owns a given IPv4 address, and the owner replies with its MAC address so frames can be delivered on the local segment. DNS resolves names to addresses, DHCP assigns configuration, and SNMP manages devices.

Question 4Network Security Fundamentals

Which port number is the default for HTTPS traffic?

  1. 22
  2. 443 Correct answer.
  3. 80
  4. 25

Explanation

HTTPS uses TCP port 443 by default to carry HTTP over TLS. Port 80 is plain HTTP, port 25 is SMTP, and port 22 is SSH.

Question 5Network Security Fundamentals

What is the primary function of a stateful packet-filtering firewall?

  1. It encrypts all outbound traffic using IPsec tunnels.
  2. It tracks active connections and permits return traffic that matches an established session. Correct answer.
  3. It assigns IP addresses to internal hosts automatically.
  4. It inspects application payloads for malware signatures before forwarding.

Explanation

A stateful firewall maintains a connection table so that replies belonging to an allowed outbound session are permitted without a separate inbound rule. Payload malware inspection belongs to deeper application-layer inspection, and address assignment is DHCP's role.

Question 6Network Security Fundamentals

Which device primarily forwards frames based on MAC addresses within a single broadcast domain?

  1. Router
  2. Load balancer
  3. Firewall
  4. Layer 2 switch Correct answer.

Explanation

A Layer 2 switch builds a MAC address table and forwards frames to the correct port within one broadcast domain. Routers move packets between networks using IP addresses.

Question 7Network Security Fundamentals

In a network diagram, what does the demilitarized zone (DMZ) segment typically contain?

  1. Internal employee workstations with sensitive data
  2. Backup tapes stored offline
  3. Public-facing servers reachable from the internet Correct answer.
  4. Core routing infrastructure only

Explanation

A DMZ is a buffer segment that hosts internet-facing services such as web and mail servers, isolating them from the internal network. If a DMZ host is compromised, the internal LAN remains separated by another control point.

Question 8Network Security Fundamentals

Which statement describes the role of NAT on a perimeter device?

  1. It provides redundant default gateways for hosts.
  2. It authenticates users before granting access to the network.
  3. It translates private internal addresses to a public address for internet-bound traffic. Correct answer.
  4. It detects intrusions by matching traffic against signatures.

Explanation

Network Address Translation rewrites source addresses so many internal hosts can share one or more public addresses when communicating externally. Authentication, intrusion detection, and gateway redundancy are handled by other mechanisms.

Question 9Network Security Fundamentals

An analyst sees repeated TCP SYN packets to many destination ports on a single host, with almost no completed handshakes. Which activity does this most likely indicate?

  1. An ARP spoofing attempt
  2. A port scan Correct answer.
  3. A DHCP starvation attack
  4. A DNS zone transfer

Explanation

Many SYNs to varied ports with few completed handshakes is the signature of a TCP SYN port scan probing for open services. A zone transfer uses TCP 53 with a specific query, while DHCP and ARP attacks involve different protocols entirely.

Question 10Network Security Fundamentals

Why does segmenting a network into VLANs improve security?

  1. It encrypts all traffic between hosts on the same VLAN automatically.
  2. It replaces the need for access control lists on routers.
  3. It limits broadcast traffic and enforces boundaries so hosts cannot directly reach other segments without routing controls. Correct answer.
  4. It assigns public IP addresses to every internal host.

Explanation

VLANs divide a physical network into logical segments, containing broadcasts and requiring traffic to cross a routing point where filtering can be applied. They do not encrypt traffic by themselves, nor do they remove the need for ACLs.

Question 11Network Security Fundamentals

A web server in the DMZ must reach a database on the internal network. Which control most directly restricts this access to only the required service?

  1. A NAT rule translating the web server address
  2. A DNS record pointing the database name to the server
  3. A VLAN trunk between the DMZ and internal switch
  4. A firewall rule permitting only the specific database port from the web server to the database host Correct answer.

Explanation

A least-privilege firewall rule that allows only the specific database port from the web server to the database host enforces the minimum required access. NAT, DNS, and trunking change addressing or transport but do not restrict which services may be reached.

Question 12Network Security Fundamentals

Which attack involves an attacker impersonating the default gateway to intercept traffic from internal hosts?

  1. Ping flood
  2. DNS cache poisoning
  3. ARP spoofing Correct answer.
  4. SYN flood

Explanation

ARP spoofing sends forged ARP replies so hosts associate the gateway's IP with the attacker's MAC, redirecting traffic through the attacker for interception. SYN and ping floods are volumetric denial-of-service techniques, and DNS cache poisoning targets resolver records.

Question 13Network Security Fundamentals

What is the security purpose of implementing 802.1X on switch ports?

  1. It encrypts all frames on the local segment.
  2. It translates private addresses to public addresses.
  3. It requires devices to authenticate before gaining network access on the port. Correct answer.
  4. It provides redundant links between switches.

Explanation

802.1X is port-based network access control: a supplicant authenticates through an authenticator to a RADIUS server before the port grants access. It does not provide link encryption, address translation, or redundancy.

Question 14Network Security Fundamentals

Which characteristic distinguishes UDP from TCP in a security context?

  1. UDP is connectionless and easier to spoof because it does not complete a handshake. Correct answer.
  2. UDP encrypts payloads by default.
  3. UDP guarantees ordered delivery and therefore resists spoofing.
  4. UDP uses a three-way handshake before data transfer.

Explanation

Because UDP is connectionless and requires no handshake, source addresses can be forged more easily, which is why UDP is often used in amplification attacks. TCP's handshake makes source spoofing harder, and neither protocol encrypts by default.

Question 15Network Security Fundamentals

A network uses a screened subnet design. What is the main benefit of placing public services there rather than on the internal LAN?

  1. It guarantees public servers cannot be attacked.
  2. It removes the need for authentication on internal systems.
  3. Compromise of a public service does not give direct access to the internal network. Correct answer.
  4. It eliminates the need for firewalls between segments.

Explanation

A screened subnet isolates internet-facing systems so that a breach there does not automatically expose the internal network; a second control point sits between the segments. It does not prevent attacks on the servers, remove firewall needs, or affect internal authentication.

Question 16Network Security Fundamentals

Which practice best mitigates DNS cache poisoning on a corporate resolver?

  1. Disabling recursion for all clients
  2. Using randomized source ports and transaction IDs with DNSSEC validation Correct answer.
  3. Allowing zone transfers from any host
  4. Relying solely on a static hosts file

Explanation

Randomized source ports and transaction IDs make guessing responses impractical, and DNSSEC validation cryptographically verifies records. Disabling recursion or using a hosts file does not secure resolution for legitimate queries, and open zone transfers leak data.

Question 17Network Security Fundamentals

An administrator wants to detect unauthorized devices connecting to an access switch. Which control provides the most direct enforcement?

  1. Enabling CDP on all ports
  2. Port security binding MAC addresses to specific switch ports Correct answer.
  3. Increasing the switch's MAC address table size
  4. Configuring a static default route

Explanation

Port security restricts which MAC addresses may appear on a port and can shut down or restrict the port when an unknown device appears. CDP, static routes, and larger MAC tables do not enforce which devices may connect.

Question 18Network Security Fundamentals

Why is source IP spoofing common in reflection and amplification attacks?

  1. Attackers can direct responses to a victim while hiding their own address. Correct answer.
  2. It guarantees the attacker receives the responses.
  3. Spoofed packets cannot be routed across the internet.
  4. It requires completing a TCP handshake first.

Explanation

In reflection attacks the attacker forges the victim's source address so that many responses are sent to the victim, amplifying the traffic and concealing the attacker. Spoofed packets are routable, and the attacker does not need to receive responses.

Question 19Network Security Fundamentals

Which protocol should be used to securely manage network devices remotely instead of Telnet?

  1. SNMPv1
  2. FTP
  3. TFTP
  4. SSH Correct answer.

Explanation

SSH provides an encrypted channel for remote administration, whereas Telnet sends credentials and session data in cleartext. FTP and TFTP are file transfer protocols without secure administration, and SNMPv1 lacks strong security.

Question 20Network Security Fundamentals

A company deploys an IPS in inline mode. What distinguishes it from an IDS in promiscuous mode?

  1. The IPS only logs alerts and never blocks traffic.
  2. The IPS can block malicious traffic in real time because traffic passes through it. Correct answer.
  3. The IPS operates only on encrypted traffic.
  4. The IPS cannot inspect packet payloads.

Explanation

An inline IPS sits in the traffic path and can drop or reset malicious packets in real time, whereas a promiscuous IDS receives a copy and can only alert. Both can inspect payloads, and neither is limited to encrypted traffic.

Question 21Network Security Fundamentals

Which statement accurately describes the difference between a hub and a switch regarding sniffing risk?

  1. A hub isolates each port into its own collision domain.
  2. A hub repeats traffic to all ports, so any attached host can see others' frames. Correct answer.
  3. A switch broadcasts every unicast frame to all ports by default.
  4. A switch cannot learn MAC addresses.

Explanation

A hub is a shared-medium repeater that sends each frame out every port, so attached hosts can observe traffic not addressed to them. A switch learns MAC addresses and forwards unicast frames only to the relevant port, reducing casual sniffing exposure.

Question 22Network Security Fundamentals

Two hosts on the same VLAN cannot communicate, but each can reach the gateway. Which troubleshooting step best isolates a Layer 2 issue?

  1. Inspect the public IP allocation pool
  2. Confirm the DNS server is reachable
  3. Verify the default route on the router
  4. Check the ARP entries and MAC address table for the two hosts Correct answer.

Explanation

Hosts that reach the gateway but not each other likely have a Layer 2 problem such as a stale ARP entry or a missing MAC table entry, so checking ARP and the switch's MAC table isolates it. Routing, DNS, and public addressing affect other paths.

Question 23Network Security Fundamentals

An attacker on a trunk port sends frames tagged for multiple VLANs to reach hosts on segments they should not access. Which mitigation addresses this VLAN hopping technique?

  1. Enable CDP on all access ports
  2. Disable dynamic trunking negotiation and set unused ports to an unused access VLAN Correct answer.
  3. Permit all VLANs on every trunk
  4. Use a native VLAN of 1 on all trunks

Explanation

Disabling DTP prevents a host from negotiating a trunk, and placing unused ports in an unused access VLAN stops them from being used to reach other segments. Permitting all VLANs or relying on the default native VLAN increases exposure.

Question 24Network Security Fundamentals

A security team observes that outbound DNS queries to external resolvers bypass the internal filtering resolver. Which control best enforces policy while preserving name resolution?

  1. Block all outbound traffic from clients
  2. Allow only DNS over HTTPS to any external provider
  3. Block direct outbound port 53 from clients and force them to use the internal resolver Correct answer.
  4. Disable DNS on all endpoints

Explanation

Blocking direct client DNS and requiring the internal resolver ensures queries pass through filtering and logging while still resolving names. Blocking all traffic or disabling DNS breaks functionality, and unrestricted DoH bypasses inspection entirely.

Question 25Network Security Fundamentals

Why does microsegmentation reduce lateral movement compared with a flat internal network?

  1. It consolidates all workloads into a single subnet.
  2. It applies granular policy between workloads so a compromised host reaches only explicitly permitted peers. Correct answer.
  3. It encrypts every packet between all hosts automatically.
  4. It removes the need for identity management.

Explanation

Microsegmentation enforces least-privilege policy between individual workloads, so a compromised host can only reach the peers its policy allows. It does not automatically encrypt all traffic, replace identity management, or consolidate subnets.

Question 26Network Security Fundamentals

Which protocol operates at the network layer to provide connectionless delivery of packets and relies on upper-layer protocols for reliability?

  1. Transmission Control Protocol (TCP)
  2. Address Resolution Protocol (ARP)
  3. Hypertext Transfer Protocol Secure (HTTPS)
  4. Internet Protocol (IP) Correct answer.

Explanation

IP is the network-layer protocol that routes packets between networks and does not guarantee delivery, ordering, or error recovery. Reliability, if needed, is added by a transport-layer protocol such as TCP. ARP maps addresses within a local segment, and HTTPS is an application-layer protocol.

Question 27Network Security Fundamentals

A workstation needs the MAC address associated with the IP address of its default gateway on the local subnet. Which protocol provides that mapping?

  1. DNS
  2. DHCP
  3. ARP Correct answer.
  4. ICMP

Explanation

ARP broadcasts a request asking which device owns a given IPv4 address, and the owner replies with its MAC address so frames can be encapsulated. DNS resolves names to IP addresses, DHCP assigns configuration, and ICMP carries control and error messages.

Question 28Network Security Fundamentals

Which port number is the default for HTTPS traffic that a perimeter firewall must usually permit inbound to a public web server?

  1. 22
  2. 3389
  3. 443 Correct answer.
  4. 80

Explanation

HTTPS by convention listens on TCP port 443, so firewall rules publishing a secure website typically allow that port. Port 80 is plain HTTP, port 22 is SSH, and port 3389 is RDP.

Question 29Network Security Fundamentals

Which statement correctly describes the function of a stateful firewall compared with a stateless packet filter?

  1. It decrypts all TLS sessions by default to inspect application payloads.
  2. It tracks active connections and can automatically permit return traffic belonging to an allowed session. Correct answer.
  3. It inspects each packet in isolation against static rules without remembering prior packets.
  4. It forwards frames only within a single broadcast domain based on MAC addresses.

Explanation

A stateful firewall maintains a connection table so that replies to an approved outbound flow are allowed without a separate inbound rule. A stateless filter evaluates each packet independently and requires explicit rules in both directions. Decryption and frame forwarding are separate functions not implied by statefulness.

Question 30Network Security Fundamentals

An organization wants a single choke point where all traffic between the internal network and the internet is inspected and logged. Which placement best achieves this?

  1. An intrusion detection sensor connected to a mirrored switch port
  2. A host-based firewall enabled on each employee laptop
  3. A VLAN configured on the core switch
  4. A firewall positioned between the internal network and the internet edge Correct answer.

Explanation

A perimeter firewall at the internet edge aggregates inter-network traffic so policy enforcement and logging occur at one controlled point. Host firewalls protect individual endpoints but do not centralize inspection of all flows, and a mirrored sensor only observes traffic rather than controlling it.

Question 31Network Security Fundamentals

A security engineer must choose a tunneling protocol that encrypts traffic between a remote employee and the corporate gateway. Which technology provides encrypted remote-access connectivity?

  1. A site-to-site GRE tunnel without encryption
  2. A TLS-based VPN client connecting to a VPN concentrator Correct answer.
  3. IPsec in transport mode between two internal hosts
  4. An unencrypted PPTP connection

Explanation

A TLS-based VPN, such as an SSL VPN client, encrypts the session between a remote user and the concentrator and is designed for remote-access scenarios. GRE alone provides encapsulation without confidentiality, and PPTP is considered obsolete and weak.

Question 32Network Security Fundamentals

Which mechanism allows a network device to authenticate users against a central repository while enforcing per-user authorization attributes returned to the device?

  1. Syslog
  2. SNMPv3
  3. NTP
  4. RADIUS Correct answer.

Explanation

RADIUS forwards authentication requests to a central server and returns authorization attributes, such as VLAN assignment, that the network access device enforces. SNMPv3 manages device state, syslog transports log messages, and NTP synchronizes clocks.

Question 33Network Security Fundamentals

An administrator configures an access control list on a router interface. Which ordering principle determines whether a packet is permitted or denied?

  1. Deny rules are evaluated before permit rules regardless of position.
  2. The most specific rule in the list always takes precedence.
  3. Rules are evaluated top to bottom and the first match is applied. Correct answer.
  4. All matching rules are combined and the majority decision applies.

Explanation

Router ACLs are processed sequentially, and the first entry that matches the packet determines the action; later entries are never examined for that packet. Administrators therefore order specific permits and denies carefully and rely on an implicit deny at the end.

Question 34Network Security Fundamentals

Which security benefit does Network Address Translation primarily provide to internal hosts communicating with external networks?

  1. It hides internal addressing so external parties cannot directly address internal hosts. Correct answer.
  2. It guarantees integrity of packets in transit.
  3. It encrypts payloads so external observers cannot read application data.
  4. It authenticates users before permitting outbound connections.

Explanation

NAT rewrites addresses so external observers see only the translating device's public address, which obscures internal topology and blocks unsolicited inbound connections. It does not provide encryption, integrity, or user authentication on its own.

Question 35Network Security Fundamentals

A security team wants to detect port scanning across a large address range without disrupting production traffic. Which deployment best fits this requirement?

  1. A passive network intrusion detection sensor attached to a monitoring port Correct answer.
  2. A web application firewall in front of the public site
  3. A host-based antivirus agent on each server
  4. An inline intrusion prevention system configured to drop suspicious packets

Explanation

A passive IDS receives a copy of traffic from a monitoring port and raises alerts without affecting the forwarding path, which suits broad detection with minimal operational risk. An inline IPS can block but risks disrupting traffic, while host and web agents cover narrower scopes.

Question 36Network Security Fundamentals

An attacker sends a flood of UDP packets with a spoofed source address to a DNS server, causing large responses to be directed at a victim. Which characteristic of UDP enables this amplification?

  1. It encrypts payloads by default.
  2. It retransmits lost segments automatically.
  3. It is connectionless and does not verify source addresses. Correct answer.
  4. It establishes a three-way handshake before data transfer.

Explanation

Because UDP is connectionless, a server can send a response to a spoofed source address without completing any handshake, allowing small requests to trigger large replies aimed at a victim. TCP's handshake makes this specific reflection pattern harder. UDP also does not encrypt by default.

Question 37Network Security Fundamentals

Which technique best defends against an attacker attempting to poison a client's ARP cache to redirect local traffic?

  1. Enabling DHCP snooping on all access ports
  2. Applying a QoS policy that prioritizes gateway traffic
  3. Configuring dynamic ARP inspection with trusted bindings on access switches Correct answer.
  4. Disabling spanning tree on user-facing ports

Explanation

Dynamic ARP inspection validates ARP packets against a trusted binding table derived from DHCP snooping, so forged replies claiming the gateway's address are dropped. DHCP snooping alone protects address assignment but does not validate ARP replies. Spanning tree and QoS do not address cache poisoning.

Question 38Network Security Fundamentals

A security analyst reviews logs showing many outbound connections to an unfamiliar external IP on port 443 with regular beacon intervals and small payloads. Which interpretation is most consistent with these indicators?

  1. Normal web browsing by a user during business hours
  2. A hardware failure causing packet retransmissions
  3. A legitimate software update check occurring once at startup
  4. Command-and-control beaconing from compromised malware Correct answer.

Explanation

Periodic, evenly spaced connections with small encrypted payloads to an unfamiliar destination are a classic sign of malware checking in with a command-and-control server. Normal browsing is irregular and user-driven, and one-time startup checks do not recur at fixed intervals.

Question 39Network Security Fundamentals

Which statement best explains why an organization places a reverse proxy in front of internal web servers?

  1. It terminates client connections and forwards requests, hiding backend server details from clients. Correct answer.
  2. It assigns IP addresses to clients that connect to the web application.
  3. It replaces the need for TLS between the proxy and the backend servers.
  4. It converts UDP traffic into TCP traffic for the backend.

Explanation

A reverse proxy accepts client connections on behalf of backend servers, which lets it hide internal addresses, centralize TLS termination, and apply filtering. It is not an address assignment service, does not automatically remove the need for backend protection, and does not perform protocol conversion of that kind.

Question 40Network Security Fundamentals

Which protocol provides integrity and origin authentication for routing updates so that routers reject unauthorized route advertisements?

  1. BGP with TCP MD5 or TCP-AO authentication Correct answer.
  2. RIPv1
  3. OSPFv2 without authentication
  4. ICMP redirects

Explanation

BGP sessions can be protected with TCP MD5 or TCP Authentication Option so that a router only accepts updates from an authenticated peer, reducing route hijacking and spoofed advertisements. RIPv1 carries no authentication, OSPFv2 without authentication is open, and ICMP redirects are not routing authentication.

Question 41Symantec Security Products and Architecture

In a Symantec Endpoint Protection deployment, which component is responsible for enforcing the security policy on a managed client and reporting status back to the management server?

  1. The Symantec Endpoint Protection Manager database
  2. The Symantec Endpoint Protection Manager console plug-in
  3. The LiveUpdate administrator utility
  4. The client software installed on the endpoint Correct answer.

Explanation

The client agent runs on the endpoint, receives policy from the manager, and enforces protections such as antivirus and firewall while reporting status upward. The manager console is an administrative interface, not an enforcement point on the host.

Question 42Symantec Security Products and Architecture

Which Symantec Endpoint Protection Manager communication mode has clients initiate connections to the manager rather than the manager pushing to clients?

  1. Multicast mode
  2. Broadcast mode
  3. Pull mode Correct answer.
  4. Push mode

Explanation

In pull mode the client initiates the connection to the manager to retrieve policy and send status, which suits clients behind NAT or firewalls. Push mode relies on the manager reaching the client directly.

Question 43Symantec Security Products and Architecture

A Symantec Endpoint Protection Manager administrator wants a group of clients to receive a stricter firewall policy while other groups keep the default. What is the correct architectural approach?

  1. Disable the firewall on the target clients and rely on the host IPS
  2. Create a new firewall policy and assign it to the target group Correct answer.
  3. Apply the stricter policy only to the manager's local client
  4. Edit the default policy so all clients inherit the stricter rules

Explanation

Policies in SEPM are assigned at the group level, so a separate policy must be created and applied to the target group to avoid affecting others. Editing the default policy would propagate the change to every inheriting group.

Question 44Symantec Security Products and Architecture

Which Symantec product provides centralized management of endpoint protection across physical and virtual endpoints in a single console?

  1. Symantec Protection Engine
  2. Symantec Mail Security for SMTP
  3. Symantec Endpoint Protection Manager Correct answer.
  4. Symantec Critical System Protection

Explanation

SEPM is the management console and server that centralizes policy, content, and reporting for endpoint clients. The other products serve mail gateways, scan engines, or server hardening roles.

Question 45Symantec Security Products and Architecture

What is the primary role of LiveUpdate in a Symantec Endpoint Protection environment?

  1. Load-balancing connections across multiple managers
  2. Storing quarantine files from infected endpoints
  3. Encrypting traffic between clients and the manager
  4. Distributing security content and product updates to clients and servers Correct answer.

Explanation

LiveUpdate retrieves virus definitions and product updates from Symantec servers and delivers them to the manager and clients. It does not handle encryption, load balancing, or quarantine storage.

Question 46Symantec Security Products and Architecture

An administrator needs reports on virus detections aggregated across all managed endpoints. Which SEPM capability fulfills this requirement?

  1. Client-side logs viewed individually on each endpoint
  2. LiveUpdate scheduler logs
  3. SEPM reporting and notification features Correct answer.
  4. Windows Event Viewer on the management server

Explanation

SEPM collects client status and logs into its database and provides reports and notifications for aggregated visibility. Individual client logs and OS event logs do not provide centralized aggregation.

Question 47Symantec Security Products and Architecture

Which Symantec technology is designed to detect malicious behavior by monitoring application actions rather than relying solely on signatures?

  1. Database replication
  2. SONAR heuristic behavior analysis Correct answer.
  3. Group policy inheritance
  4. LiveUpdate content distribution

Explanation

SONAR observes process behavior and reputation to catch threats that lack known signatures. The other options are management or content-distribution functions, not behavioral detection.

Question 48Symantec Security Products and Architecture

A company wants to protect virtualized desktops by scanning guest images without installing a full agent in every guest. Which Symantec capability addresses this?

  1. Application and device control
  2. Host integrity checks
  3. SMTP gateway filtering
  4. Virtual Image Exception and shared scan caching for virtual environments Correct answer.

Explanation

SEP for virtual environments uses shared scanning and image exceptions to reduce resource consumption across guests. The other features address mail, compliance checks, or device control rather than virtualization efficiency.

Question 49Symantec Security Products and Architecture

What does a Symantec Endpoint Protection Manager replication partnership accomplish?

  1. It duplicates security content across client groups
  2. It synchronizes management data between multiple managers for redundancy and scale Correct answer.
  3. It mirrors the manager console to client desktops
  4. It replicates client quarantine files to a central share

Explanation

Replication keeps configuration, logs, and policy consistent across multiple managers, supporting failover and distributed administration. It is not used for content distribution, quarantine replication, or console mirroring.

Question 50Symantec Security Products and Architecture

An administrator must ensure endpoints can still receive updated definitions when the manager cannot reach Symantec's LiveUpdate servers. Which configuration supports this?

  1. Point all clients directly at the manager database
  2. Rely on the operating system's built-in updater
  3. Disable LiveUpdate on all clients
  4. Configure a group update provider to serve content to peers Correct answer.

Explanation

A group update provider downloads content and redistributes it to peers, reducing reliance on external connectivity for each client. Disabling updates or using OS updaters does not deliver Symantec definitions.