A newly installed Symantec Endpoint Protection (SEP) client downloads a full.zip file from the Symantec Endpoint Protection Manager (SEPM) to update its content soon after installation. This is expected.
When the SEP client next updates, it downloads another full.zip file rather than a delta (.dax file). This is unexpected and utilizes more network bandwidth than necessary.
This issue has been resolved in SEP RU6 MP3 (11.0.6303.803) and above. Upgrade to this build or above to take advantage of this fix.