Forcepoint DSPM- Deploy-and-Administer Certified Forcepoint DSPM - Professional: Deploy and Administer Exam Exam Practice Test

The correct answer is D. Enhances data security . In Forcepoint DSPM, taxonomy is the structured classification model used to assign sensitivity meaning to discovered data. Forcepoint describes taxonomy as a machine-learning-based structured classification system that assigns sensitivity levels such as Confidential , General Business , Public , and Highly-Confidential . This classification directly corresponds to the Classification column in scan results, allowing security and governance teams to understand how sensitive a file or data asset is after scanning.

A custom taxonomy improves security because it lets an organisation align DSPM classification labels with its own internal data-handling rules, security protocols, and business language. Forcepoint notes that taxonomy customization ensures data handling aligns with an organisation’s security protocols, and that applied tags are visible in the Data Asset Inventory . In the administration taxonomy workflow, Forcepoint also explains that predefined AI Mesh tags can be supplemented with custom tags for pattern matching and detection rules, and those tags can be mapped to data-source taxonomies for label writeback.

The other options describe possible operational goals but not the primary purpose of taxonomy. Taxonomy is not an authentication mechanism, deduplication feature, or storage-reduction tool. References/topics: Taxonomy, Classification Tags, AI Mesh, Pattern Matching, Data Asset Inventory, Compliance Hub .

The correct answer is Sync Registrations . In Forcepoint DSPM, Active Directory users are imported through Keycloak User Federation . The Forcepoint DSPM administration workflow directs administrators to access Keycloak, select the gv realm, navigate to User Federation , and add an LDAP provider for AD integration.

In Keycloak LDAP configuration, READ_ONLY edit mode means Keycloak can read LDAP-backed user data, but it cannot modify mapped LDAP attributes such as username, email, first name, last name, or passwords. Keycloak’s own administration guide states that READ_ONLY prevents user attribute changes and password updates, while WRITABLE mode is the mode that allows changes to be synchronized back to LDAP.

That makes Sync Registrations irrelevant in READ_ONLY mode because Sync Registrations is specifically used when newly created Keycloak users should also be added to LDAP. Since READ_ONLY mode prevents Keycloak from writing new or modified user objects back to LDAP, registration synchronization has no useful effect in that configuration. By contrast, Import users , Periodic full sync , and Periodic changed users sync remain relevant because they are read-oriented synchronization mechanisms that bring LDAP/AD identities into DSPM’s Keycloak-backed identity layer. References/topics: Keycloak User Federation, LDAP Edit Mode, READ_ONLY Mode, AD Import, Synchronization Settings .

Workflow Configuration Tool → Allows the creation of GQL syntax rules with conditions for organizational files and users.

Rule-Based Automation → Establish criteria to identify data policy violations, data handling irregularities, and other anomalies.

Notification System → Triggered rules can be configured to generate alerts and send them to webhooks to ensure prompt action.

Incident Management → Review events and manage rules through cards.

Controls Orchestration in Forcepoint DSPM is the policy automation layer used to convert data-risk criteria into reviewable operational events. The Workflow Configuration Tool is represented by the rule-building interface under Policy Center > Controls Orchestration , where administrators define datasets, ownership, rule conditions, and GQL logic for organizational files, trustees, or agent activities. Forcepoint states that rules are created to identify data matching specific criteria and are applied during scans of the selected dataset.

Rule-Based Automation describes the criteria-driven detection model. Administrators establish rules that identify policy violations, data-handling irregularities, or other anomalies that require attention. Notification System maps to the ability to configure triggered rules to send external notifications, including webhook-based alerts, when matching data is detected. Incident Management maps to the Incidents workflow: Forcepoint states that each rule is automatically added as a card in the Incidents tab, and selecting the card takes the user back to the associated rule. References/topics: Policy Center, Controls Orchestration, GQL Conditions, Notifications, Webhooks, Incidents .

The correct answer is A . Forcepoint DSPM pattern matching is designed to let administrators define and tune custom detection logic for organisation-specific sensitive data. The documented pattern-matching function identifies particular information in documents by using Regular Expressions , and Forcepoint notes that pattern matching uses Golang RegEx syntax, which is separate from Detector syntax.

When a new pattern is added under Administration > Pattern Matching , the configuration includes Pattern Name , Regular Expression , enablement state, hidden RegEx handling, and tag assignments for Classification , Compliance , and Distribution . Forcepoint states that the Regular Expression is “the sequence to be matched,” and that selected tags can override machine-learning model output during endpoint suggestions and file scans. This supports the principle that custom patterns can be adjusted so the RegEx better matches an organisation’s data formats, identifiers, project codes, or regulatory artifacts.

The other statements do not match the documented pattern workflow. Country assignment is not presented as a core custom-pattern field. Export/import of data patterns is not part of the stated pattern-matching configuration flow. Default or preconfigured patterns are provided as built-in detection content and should not be treated as administrator-editable RegEx templates. References/topics: Pattern Matching, Add New Pattern, RegEx, Classification Tags, Compliance Tags, Distribution Tags .

The correct answers are Widgets and Panels . In Forcepoint DSPM Analytics, dashboards are organized as boards that present scan-derived security, compliance, and data-risk information. The primary structural components used to build those dashboards are panels and widgets. Forcepoint states that dashboards are “primarily constructed of panels and widgets,” and explains that each panel can contain one or more widgets. A panel acts as the container that organizes multiple visual components into a coherent dashboard layout, while a widget is the smaller information component that displays data from selected datasets such as files, trustees, connectors, or agents.

This structure matters because dashboards are not just static reports; they are configurable analytical workspaces. Widgets provide the actual data presentation, such as counters, charts, maps, text blocks, tables, incidents, dual data grouping, or multi-counter views. Forcepoint separately lists these as available widget types, each with its own customization options. Panels then provide the organizational layer that groups these widgets logically by use case, such as exposure, classification, incident review, user risk, or compliance posture. Toggle switches, menus, and status bars may appear in the interface, but they are not the dashboard-building elements. References/topics: Analytics, Components of a Dashboard, Widgets, Panels, Custom Dashboards .

The correct answer is B . Forcepoint DSPM Controls Orchestration rules are built around query-driven rule logic. In the rule configuration workflow, administrators select a dataset such as Files , Trustees , or Agent Activities , then configure the rule condition using GQL syntax . This GQL condition defines which records match the rule and therefore which results appear as incidents when the rule is triggered. Forcepoint documentation states that Controls Orchestration rules identify data matching specific criteria and that the Condition field uses GQL syntax to filter the selected dataset.

When reviewing incidents, Forcepoint’s Incidents page provides a top-down view of orchestration rules and available match results. Selecting an incident card opens a results preview, and choosing View in the Page displays those matched files in Enterprise Search , where additional review and action options are available. Enterprise Search is specifically designed to narrow scanned-file results using GetVisibility Query Language , and Forcepoint notes that GQL filtering helps reduce the result set to a more manageable subset for analysis and action.

Timestamp, Risk type, and keyword filtering may be useful in other contexts, but the documented advanced review mechanism for these results is GQL-based filtering. References/topics: Controls Orchestration, Incidents, Enterprise Search, GQL Filtering, Rule Match Review .

In Forcepoint DSPM, data ownership is treated as an explicit governance assignment tied to the organisation’s data asset inventory and data sources, not as a passive attribute inferred only from file metadata or imported directory fields. The closest correct option is C , because ownership is assigned at the data storage/data source or data asset level so that accountability, alert routing, review responsibility, and remediation workflows have a clearly identified business owner.

Forcepoint documentation describes the Data Asset Inventory workflow as requiring organisations to “assign an owner” for each asset and states that DSPM can “assign specific data owners to each data source.” This aligns with DSPM’s governance model: the owner is the accountable stakeholder for the data asset, not merely the technical file creator or last modifier. Release notes also describe a Data Owner column on the Data Assets page, where ownership may be automatically selected based on department owner and manually changed by the user.

Therefore, A is incorrect because policies define controls and requirements, not the owner itself. B is too narrow because imported user properties support identity context but do not alone define data ownership. D is incorrect because file owner metadata is not the authoritative ownership model for DSPM governance. References/topics: Data Register, Data Asset Inventory, Data Ownership, Controls Orchestration, Access Governance .

Click EDIT WIDGETS in the upper-right area of the dashboard.

Ella should click the EDIT WIDGETS button near the upper-right side of the dashboard, beside the EXPORT PDF button. This control opens the dashboard edit view, which exposes the controls required to modify dashboard content, including adding widgets and adding panels. In the screenshot, the correct click target is the green-outlined EDIT WIDGETS button above the dashboard panels.

Forcepoint documents dashboards as being primarily constructed from panels and widgets . A panel is the container that organizes one or more widgets, while widgets display selected datasets such as files, trustees, connectors, agents, or other DSPM analytics data. The Forcepoint documentation specifically states: “Edit Widgets: Click the Edit Widget button, to open the edit view.” It then lists Add widget and Add panel as functions available from that edit mode.

Therefore, Ella cannot add a panel by clicking the existing charts, the left navigation list, or the dashboard title. She must first enter edit mode through EDIT WIDGETS , then use the available Add panel option. References/topics: Analytics, Components of a Dashboard, Edit Widgets, Add Panel, Panels and Widgets .

The correct answer is C . Forcepoint DSPM allows frequently used Enterprise Search filters to be saved as bookmarks, which is the appropriate method for Anna’s weekly workflow. The documented Enterprise Search capability states that the page lets users access recently used filters, save frequently used filters as bookmarks, customize column headings, and generate meaningful reports. It also supports advanced filtering through GetVisibility Query Language , where a GQL query narrows scanned-file results to a focused, manageable subset for analysis and action.

Operationally, Anna would go to Enterprise Search , enter the complex GQL filter in the search/query field, execute or validate the filter, and then select the star icon to bookmark it. Forcepoint support documentation confirms that administrators can save complex GQL queries by using the star icon, creating a GQL bookmark, and providing an appropriate description.

The other options are incorrect because DSPM does not use an Excel import workflow to load reusable GQL filters from Analytics or Enterprise Search. Administration is also not the documented location for saving Enterprise Search GQL bookmarks. References/topics: Enterprise Search, GQL Filtering, Bookmarked Filters, Exporting Data, Reusable Search Workflows .

The correct selections are A, C, D, and E . A data classification and handling policy is a governance artifact that defines how data assets are categorized, owned, protected, reviewed, and aligned to legal or regulatory requirements. In Forcepoint DSPM, this sits within Policy Center and Compliance Hub , which are designed to support data classification, policy creation, security-control implementation, compliance, and risk reduction. Forcepoint states that Policy Center streamlines policy creation and prompts organizational representatives to provide information needed to build a governance framework aligned to organizational goals.

Specifying asset requirements maps to Data Mapping, where organizations define Data Asset Inventory fields and metadata such as retention period, business owner, regulatory scope, review status, and project name. Incorporating industry-specific regulations is required because departmental policy design must reflect obligations such as GDPR, HIPAA, and PCI DSS. Defining classification levels aligns to Taxonomy, where sensitivity levels such as Confidential, General Business, Public, and Highly Confidential are configured. Outlining roles and responsibilities aligns to assigning policy owners, department heads, representatives, and accountable stakeholders. Network traffic protocols are not a core step in creating a data classification and handling policy; they belong to network architecture or transport-control design, not data governance policy creation.

Forcepoint DSPM pattern matching is used to identify defined pieces of information inside scanned content by applying regular expressions. The documented function is discovery and classification: pattern matching identifies particular information in a document by using RegEx that attempts to match file content. This makes identifying personally identifiable information on SharePoint the correct use case. SharePoint is a supported Microsoft data source for scanning, and Forcepoint specifically documents SharePoint Online as a connector used to scan SharePoint accounts and apply classification tags to files containing sensitive data stored in SharePoint.

The key distinction is that pattern matching does not perform remediation actions such as redaction or encryption. Options B and D therefore overstate the capability: Forcepoint DSPM may discover and classify sensitive data that later informs controls, but the pattern itself is not a redaction or encryption engine. Option A is less precise in this context because the question is testing the canonical pattern-matching use case against scanned documents and repositories, while the strongest documented repository example among the choices is SharePoint. Pattern configuration can also assign classification, compliance, and distribution tags when a RegEx is detected, such as GDPR/PII tagging for identifiers. References/topics: Pattern Matching, RegEx, Compliance Tags, SharePoint Scanning, Sensitive Data Classification .

Triggered Controls Orchestration rule events are found under Incidents . In Forcepoint DSPM, Controls Orchestration rules are designed to identify data that requires attention by evaluating selected datasets, such as files, trustees, or agent activities, against rule conditions. When a rule condition is met, the result is operationalized as an incident so the security or governance team can review the matched data and determine the appropriate response.

Forcepoint’s documentation states that each Controls Orchestration rule is “automatically added as a card in the Incidents tab,” and selecting an incident card takes the administrator back to the related rule. It also explains that the Incidents section provides a top-down view of all orchestration rules and available match results. The documented navigation path is Policy Center > Incidents .

The other options are not the correct location for triggered orchestration events. Default dashboards and overviews provide summary visibility, but they are not the dedicated rule-event review workspace. Analytics supports broader investigation and reporting, but Controls Orchestration match results are reviewed through the Incidents workflow. References/topics: Policy Center, Controls Orchestration, Incidents, Rule Match Results, Enterprise Search Review .