SNAP study guide
SNAP · Work through your exam, one topic at a time.
The Symantec Network Associate Program (SNAP) is a foundational networking-security credential aimed at people who need to work confidently with Symantec security technology rather than specialise in a single product. It suits help-desk and NOC staff, junior security analysts, systems and network administrators, and pre-sales or support engineers who touch endpoint protection, secure web and mail gateways, network access control, and logging infrastructure in day-to-day operations. The SNAP study guide has 8 sections and about 2,406 words.
01Network Security Fundamentals
The Network Security Fundamentals domain checks whether you can reason about packet flow, trust boundaries, and control placement rather than reciting acronyms. Expect questions on TCP/IP layers, common ports, stateful vs stateless filtering, NAT, VPNs, proxies, segmentation, and the difference between detection and prevention.
327 words, about 2 min02Symantec Security Products and Architecture
This domain covers how Symantec endpoint and network security components fit together: management server, database, console, clients, replication, and update distribution. You should know which component enforces a policy and which one merely reports.
327 words, about 2 min03Threat Landscape and Malware Analysis
The threat domain tests whether you can classify malware, describe modern attack chains, and choose appropriate analysis evidence. Expect ransomware, fileless/LotL attacks, phishing, supply-chain compromise, APTs, and the difference between static and dynamic analysis.
301 words, about 2 min04Endpoint Security and Management
This domain focuses on deploying and tuning Symantec Endpoint Protection: antivirus, SONAR behavior detection, intrusion prevention, firewall, application and device control, exceptions, and client management. Questions often test policy scope and troubleshooting.
286 words, about 1 min05Network Access Control and Policy Enforcement
This domain tests NAC concepts and enforcement: authentication, authorization, posture assessment, quarantine/remediation, and the roles of supplicant, authenticator, and authentication server. Expect 802.1X, EAP, RADIUS, MAB, guest VLANs, and agent vs agentless posture checks.
296 words, about 1 min06Security Monitoring, Logging, and Incident Response
This domain covers log sources, centralized monitoring, correlation, retention, time synchronization, and the incident-response lifecycle. Expect questions on evidence handling and the order of containment versus eradication.
272 words, about 1 min07Data Protection and Encryption
This domain tests data classification, data-loss prevention, encryption at rest and in transit, key management, and the differences among hashing, tokenization, and encryption. Expect Symantec DLP concepts such as endpoint, network, and storage channels, plus policy tuning.
306 words, about 2 min08Compliance, Risk, and Security Best Practices
This domain checks whether you can connect controls to risk and compliance obligations without treating a checklist as security. Expect risk assessment, control types, frameworks such as PCI DSS, HIPAA, GDPR, ISO 27001, and NIST, plus evidence, change control, and third-party risk.
291 words, about 1 min