An Incident Responder Launches a Search from ATP for a File

An Incident Responder launches a search from ATP for a file hash. The search returns the results immediately. The responder reviews the Symantec Endpoint Protection Manager (SEPM) command status and does NOT see an indicators of compromise (IOC) search command. How is it possible that the search returned results?

A) The search runs and returns results in ATP and then displays them in SEPM.
B) This is only an endpoint search.
C) This is a database search; a command is NOT sent to SEPM for this type of search.
D) The browser cached result from a previous search with the same criteria.

Correct Answer:

Verified

Unlock this answer now
Get Access to more Verified Answers free of charge

Access For Free