An Incident Responder launches a search from ATP for a file hash.

Symantec 250-441 Question Answer

An Incident Responder launches a search from ATP for a file hash. The search returns the results

immediately. The responder reviews the Symantec Endpoint Protection Manager (SEPM) command status and

does NOT see an indicators of compromise (IOC) search command.

How is it possible that the search returned results?

The search runs and returns results in ATP and then displays them in SEPM.

This is only an endpoint search.

This is a database search; a command is NOT sent to SEPM for this type of search.

The browser cached result from a previous search with the same criteria.

250-441 PDF/Engine

Get 60% Discount on All Products, Use Coupon: "8w52ceb345"