QUESTION 15
Which security control focuses on restricting application behavior rather than file reputation?

QUESTION 16
Which SES Policy protects against port scan detections?

QUESTION 17
An organization wants to block unauthorized scripting tools without impacting approved software. Which control is most suitable?

QUESTION 18
Using the ICDm console, a SES administrator issues a device command. When will the command be executed on the endpoint?

QUESTION 19
Which MITRE ATT&CK tactic involves maintaining access over time?

QUESTION 20
Which statement best summarizes SES Complete security controls?

QUESTION 21
An endpoint attempts to execute a script from an untrusted source. Which SES Complete capability is most relevant?

QUESTION 22
A threat attempts to disable endpoint protection services. Which SES Complete capability helps detect this behavior?

QUESTION 23
After containing a threat, what should be done next to prevent recurrence?

QUESTION 24
Which type of attack is specifically addressed by Threat Defense for Active Directory?

QUESTION 25
What is the name of the cloud-based Management Console that is used to configure and manage an SES Complete implementation?

QUESTION 26
Why is rapid threat response important?

QUESTION 27
Which indicator is most likely to trigger an EDR alert?

QUESTION 28
Why is searching ICDm data critical during threat investigations?

QUESTION 29
What is a key benefit of automatic content updates?

QUESTION 30
What is the purpose of Custom Application Behavior rules?

QUESTION 31
What outcome is expected from properly configured ICDm workflows?

QUESTION 32
What is a key step in an effective ICDm investigation workflow?

QUESTION 33
Which actions can be taken as part of threat mitigation?
(Select all that apply)

QUESTION 34
Which action helps remove malicious artifacts from an endpoint?

QUESTION 35
An analyst needs to identify all endpoints that communicated with a suspicious IP address. Which ICDm capability should be used?

QUESTION 36
An unknown executable is detected attempting to run on an endpoint. Which control helps restrict its execution without disrupting known applications?

QUESTION 37
Multiple failed authentication attempts followed by a successful login are detected. What does this most likely indicate?

QUESTION 38
Which control is most effective against zero-day threats?

QUESTION 39
Which statement best describes the relationship between EDR and prevention controls?