Scenario:
An enterprise security team notices that several users have recently accessed resources they typically do not use. TDAD has raised alerts regarding credential misuse and suspicious lateral movement patterns.
Which two actions should the team take using SES Complete? (Choose two)

• A. Investigate authentication paths flagged by TDAD
• B. Uninstall and reinstall AD group policies
• C. Switch the TDAD policy from monitor to active blocking mode
• D. Configure additional sensors on all file servers

Your company has recently deployed Symantec SES Complete, including the Threat Defense for Active Directory module. During an internal audit, security analysts identify a pattern of service account enumeration and repeated login failures from one administrative subnet.
What actions should the security team take using the capabilities provided by Threat Defense for Active Directory? (Choose three)

• A. Create a rule that alerts and isolates endpoints exhibiting repeated enumeration patterns.
• B. Validate the login attempts through the ICDm console's forensic timeline.
• C. Configure the SES policy to temporarily lock all user accounts.
• D. Immediately remove all users from the Domain Admins group to prevent escalation.
• E. Use real-time analysis to detect whether the activity is consistent with Kerberoasting behavior.

What role does the MITRE ATT&CK framework play in SES Complete configuration?

• A. Serves as a structure to map threat prevention capabilities
• B. Provides guidelines for UI design
• C. Determines licensing cost
• D. Manages endpoint firmware updates

Which step typically initiates the threat incident lifecycle in ICDm?

• A. Identification of a suspicious activity
• B. Execution of a scan
• C. Quarantine of a device
• D. Updating of a security policy