Symantec Updated 250-580 Exam Questions and Answers by bleu

To enhance security and prevent further attempts from the intruder after the Intrusion Prevention System (IPS) has detected and blocked an attack, the administrator should enable the setting toAutomatically block an attacker's IP address. Here’s why this setting is critical:

Immediate Action Against Threats: By automatically blocking the IP address of the detected attacker, the firewall can prevent any further communication attempts from that address. This helps to mitigate the risk of subsequent attacks or reconnections.

Proactive Defense Mechanism: Enabling this feature serves as a proactive defense strategy, minimizing the chances of successful future intrusions by making it harder for the attacker to re-establish a connection to the network.

Reduction of Administrative Overhead: Automating this response allows the security team to focus on investigating and remediating the incident rather than manually tracking and blocking malicious IP addresses, thus optimizing incident response workflows.

Layered Security Approach: This setting complements other security measures, such as intrusion detection and port scan detection, creating a layered security approach that enhances overall network security.

Enabling automatic blocking of an attacker’s IP address directly addresses the immediate risk posed by the detected intrusion and reinforces the organization’s defense posture against future threats.

In Symantec Endpoint Detection and Response (SEDR), thetimeout for the file deletion commandis set to72 hours (3 days). This means that once a deletion command is issued, it remains active for 72 hours, allowing sufficient time for the command to execute, especially in scenarios where the endpoint may not immediately respond due to network issues or system unavailability.

References: This configuration aligns with Symantec’s endpoint response protocols for command timeout windows in SEDR systems​.