Broadcom 250-580 Exam Questions

When an Incident Responder determines that an endpoint is compromised, the first action to contain the threat is to use the Isolation feature in Symantec Endpoint Detection and Response (SEDR). Isolation effectively disconnects the affected endpoint from the network, thereby preventing the malicious threat from communicating with other systems or spreading within the network environment. This feature enables the responder to contain the threat swiftly, allowing further investigation and remediation steps to be conducted without risk of lateral movement by the attacker.

For organizations with Symantec Endpoint Protection Manager (SEPM) servers that do not have internet access and require updates only within a specific maintenance window, the JDB file method is an effective solution:

Offline Content Distribution: JDB files can be downloaded on an internet-connected device and then manually transferred to SEPM, allowing it to update content offline.

Flexible Timing: Since JDB files can be applied during the maintenance window, this method adheres to time restrictions, avoiding disruption during business hours.

Using JDB files ensures that SEPM remains updated in environments with limited connectivity or strict operational schedules.

To integrate Symantec Endpoint Detection and Response (SEDR) with Symantec Endpoint Protection (SEP) effectively, the recommended configuration order is ECC, Synapse, then Insight Proxy.

Order of Configuration:

ECC (Endpoint Communication Channel): This establishes the communication layer for SEDR and SEP integration, which is foundational for data exchange.

Synapse: This integration uses data from ECC to correlate threat intelligence and provide context to detected threats.

Insight Proxy: Configured last, Insight Proxy adds cloud-based file reputation lookups, enhancing detection capabilities with reputation scoring.

Why This Order is Effective:

Each component builds on the previous one, maximizing the value of integration by ensuring that foundational communication (ECC) is established before adding Synapse correlation and Insight Proxy reputation data.

LiveShell is a Symantec tool available across multiple platforms, including Windows, Linux, and Mac. It enables administrators to open a live command-line shell on endpoints, providing remote troubleshooting and response capabilities regardless of the operating system.

Cross-Platform Availability:

LiveShell's cross-platform support ensures that administrators can respond to incidents, troubleshoot issues, and run commands on endpoints running Windows, Linux, or macOS.

Use Cases for LiveShell:

This tool is useful for incident response teams needing quick access to endpoints for commands or scripts, which helps to manage and mitigate threats across diverse environments.

Living off the land (LOTL) is a tactic where adversaries leverage existing tools and resources within the environment for malicious purposes. This approach minimizes the need to introduce new, detectable malware, instead using trusted system utilities and software already present on the network.

Characteristics of Living off the Land:

LOTL attacks make use of built-in utilities, such as PowerShell or Windows Management Instrumentation (WMI), to conduct malicious operations without triggering traditional malware defenses.

This method is stealthy and often bypasses signature-based detection, as the tools used are legitimate components of the operating system.

Why Other Options Are Incorrect:

Opportunistic attack (Option A) refers to attacks that exploit easily accessible vulnerabilities rather than using internal resources.

File-less attack (Option B) is a broader category that includes but is not limited to LOTL techniques.

Script kiddies (Option C) describes inexperienced attackers who use pre-made scripts rather than sophisticated, environment-specific tactics.