Endpoint Security and Management
What this domain tests
This domain focuses on deploying and tuning Symantec Endpoint Protection: antivirus, SONAR behavior detection, intrusion prevention, firewall, application and device control, exceptions, and client management. Questions often test policy scope and troubleshooting.
Core rules
- Layered endpoint controls: virus and spyware scanning, SONAR/heuristic behavior blocking, network intrusion prevention, host firewall, and application/device control.
- Policy targeting follows groups. Exceptions should be as narrow as possible: hash, path, signer, or process, scoped to the smallest group.
- Scheduled scans balance coverage and performance; real-time scanning handles new files.
- Tamper protection prevents users or malware from disabling services; disabling it for convenience weakens the endpoint.
- Client deployment can use push, packages, images, or third-party tools; verify communication and content update status afterward.
Worked example
A business application is quarantined after a SONAR update. Reasoning: confirm the detection name and whether it is signature-based or behavior-based. Reproduce in a test group, capture the file hash and signer, and verify the vendor. If legitimate, create a targeted exception by hash and signer for the affected group, document the business approval, and monitor. Do not disable SONAR globally or exclude an entire drive. Re-enable detection after the vendor supplies a clean build.
Traps
- Creating broad folder exceptions that mask future malware.
- Disabling tamper protection permanently.
- Applying a test policy to the root group.
- Forgetting that offline clients keep cached policy.
- Assuming a deployed client is automatically updated and compliant.