Loading demo links...
Showing 1–10 of 10 questions
DRAG DROP
Which level of privilege corresponds to each ATP account type?
Match the correct account type to the corresponding privileges.
Select and Place:
Answer is in the explanation below.
An Incident Responder documented the scope of a recent outbreak by reviewing the incident in the ATP manager.
Which two entity relationship examples should the responder look for and document from the Incident Graph? (Choose two.)
Select all that apply, then click Submit answer.
An intranet website that is experiencing an increase in traffic from endpoints in a smaller branch office.
A server in the DMZ that was repeatedly accessed outside of normal business hours on the weekend.
A network share is repeatedly accessed during and after an infection indicating a more targeted attack.
A malicious file that was repeatedly downloaded by a Trojan or a downloader that infected multiple endpoints.
An external website that was the source of many malicious files.
An Incident Responder has noticed that for the last month, the same endpoints have been involved with malicious traffic every few days. The network team also identified a large amount of bandwidth being used over P2P protocol.
Which two steps should the Incident Responder take to restrict the endpoints while maintaining normal use of the systems? (Choose two.)
Select all that apply, then click Submit answer.
Report the users to their manager for unauthorized usage of company resources
Blacklist the domains and IP associated with the malicious traffic
Isolate the endpoints
Blacklist the endpoints
Find and blacklist the P2P client application
Which two actions can an Incident Responder take in the Cynic portal? (Choose two.)
Select all that apply, then click Submit answer.
Configure a SIEM feed from the portal to the ATP environment
Configure email reports on convictions
Submit false positive and false negative files
Query hashes
Submit hashes to Insight
Which two non-Symantec methods for restricting traffic are available to the Incident Response team? (Choose two.)
Select all that apply, then click Submit answer.
Temporarily disconnect the local network from the internet.
Create an Access Control List at the router to deny traffic.
Analyze traffic using Wireshark protocol analyzer to identify the source of the infection.
Create a DNS sinkhole server to block malicious traffic.
Isolate computers so they are NOT compromised by infected computers.
An Incident Responder wants to run a database search that will list all client named starting with SYM.
Which syntax should the responder use?
Select an option, then click Submit answer.
hostname like “SYM”
hostname “SYM”
hostname “SYM*”
hostname like “SYM*”
Where can an Incident Responder view Cynic results in ATP?
Select an option, then click Submit answer.
Events
Dashboard
File Details
Incident Details
How does an attacker use a zero-day vulnerability during the Incursion phase?
Select an option, then click Submit answer.
To perform a SQL injection on an internal server
To extract sensitive information from the target
To perform network discovery on the target
To deliver malicious code that breaches the target
Which stage of an Advanced Persistent Threat (APT) attack does social engineering occur?
Select an option, then click Submit answer.
Capture
Incursion
Discovery
Exfiltration
An Incident Responder discovers an incident where all systems are infected with a file that has the same name and different hash. As a result, the organism view has multiple entries for the malicious file.
What is causing this issue?
Select an option, then click Submit answer.
This is a polymorphic threat
This is a DDoS attack
The file has multiple hashes
The file is trying to phone home
This page holds a free practice test for the Administration of Symantec Advanced Threat Protection 3.0 (250-441) certification from Symantec. You will find 10 free questions, drawn from the full Study4Pass practice set of 95 questions for this exam. The free sample includes 5 single-answer, 4 multiple-answer and 1 drag-and-drop questions — the same mix of formats you will meet in the full set. The questions follow the same topic balance as the real exam: System Architecture and Design, Security Technologies, Network Security and Data Protection. The Symantec 250-441 exam is a certification exam for the Symantec Data Loss Prevention (DLP) 14.5 Technical Assessment.
The target audience for the Symantec 250-441 exam is experienced IT professionals who have a working knowledge of Symantec Data Loss Prevention (DLP) products and services. The recommended prerequisite for the Symantec 250-441 exam is at least three years of experience in the installation, configuration, and administration of Symantec products and solutions.
Use the sample the way you would use the real thing: answer each question on your own first, then open the explanation and make sure you understand why the right answer is right. That habit — reasoning instead of memorizing — is what carries over to exam day. When a topic keeps tripping you up, that is your study plan telling you where to go next.
When you finish the sample, do not just count the score — read it. Every missed question names a topic, and the full set lets you train that topic on its own until it stops costing you marks. That loop of test, review and targeted practice is how this set is designed to be used, from the first free question to the last simulation.
Inside the full 250-441 practice set:
Pick an answer for each question and check it straight away — the correct answer and a full explanation appear under the question. There is no time limit and nothing to sign up for. When an explanation is not enough, use Ask AI: this is an AI-Enabled practice test, and Ask AI explains the concept behind the question in plain language. Ready for more? The full 95-question set adds a timed Exam Simulation mode, topic training for your weak areas, and a flagged-question review, so you can practise the way the real exam feels.
Yes — the 10 questions on this page are completely free, with no signup and no payment details needed.
95 questions. The 10 free questions above are a sample of that full set, in the same style and topic balance.
Yes — every question shows the correct answer with an explanation, and Ask AI can explain the concept behind a question in plain words if you want to go deeper.
No. This is a practice test: the questions are written to mirror the real 250-441 exam’s topics and difficulty, not copied from it.
