Administration of Symantec Endpoint Protection 12.1: 250-315

Which action does the Shared Insight Cache (SIC) server take when the whitelist reaches maximum capacity?

A. The SIC server allocates additional memory for the whitelist as needed.

B. The SIC server will start writing the cache to disk.

C. The SIC server will remove the least recently used items based on the prune size.

D. The SIC server will remove items with the fewest number of votes.

In the virus and Spyware Protection policy, an administrator sets the First action to Clean risk and sets If first action fails to Delete risk.

Which two factors should the administrator consider? (Select two.)

A. The deleted file may still be in the Recycle Bin.

B. IT Analytics may keep a copy of the file for investigation.

C. False positives may delete legitimate files.

D. Insight may back up the file before sending it to Symantec.

E. A copy of the threat may still be in the quarantine.

Which step is unnecessary when an administrator creates an application rule set?

A. define a provider

B. select a process to apply

C. select a process to exclude

D. define rule order