Summer Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

Symantec 250-587 Symantec Data Loss Prevention 16.x Administration Technical Specialist Exam Practice Test

Demo: 32 questions
Total 108 questions

Symantec Data Loss Prevention 16.x Administration Technical Specialist Questions and Answers

Question 1

Which two automated response rules will be active in policies that include Exact Data Matching (EDM) detection rule? (Choose two.)

Options:

A.

Endpoint Discover: Quarantine File

B.

All: Send Email Notification

C.

Endpoint Prevent: User Cancel

D.

Endpoint Prevent: Block

E.

Network Protect: Quarantine File

Question 2

What is the default fallback option for the Endpoint Prevent Encrypt response rule?

Options:

A.

Block

B.

User Cancel

C.

Encrypt

D.

Notify

Question 3

Which type of detector integrates with Symantec CloudSOC?

Options:

A.

Cloud Detection Service for REST

B.

Cloud Detection Service for ICAP

C.

Cloud Detection Service for SMTP

D.

Cloud Prevent detector

Question 4

What are two reasons an administrator should utilize a manual configuration to determine the endpoint location? (Choose two.)

Options:

A.

To specify Wi-Fi SSID names

B.

To specify an IP address or range

C.

To specify the endpoint server

D.

To specify domain names

E.

To specify network card status (ON/OFF)

Question 5

What is the correct configuration for “BoxMonitor.Channels” that will allow the server to start as a Network Monitor server?

Options:

A.

Packet Capture, Span Port

B.

Packet Capture, Network Tap

C.

Packet Capture, Copy Rule

D.

Packet capture, Network Monitor

Question 6

A DLP administrator needs to stop the PacketCapture process on a detection server. Upon inspection of the Server Detail page, the administrator discovers that all processes are missing from the display.

What are the processes missing from the Server Detail page display?

Options:

A.

The detection server Display Control Process option is disabled on the Server Detail page.

B.

The Display Process Control setting on the Advanced Settings page is disabled.

C.

The detection server PacketCapture process is displayed on the Server Overview page.

D.

The Advanced Process Control setting on the System Settings page is deselected.

Question 7

Which statement accurately describes where Optical Character Recognition (OCR) components must be installed?

Options:

A.

The OCR engine must be installed on detection server other than the Enforce server.

B.

The OCR server software must be installed on one or more dedicated (non-detection) Linux servers.

C.

The OCR engine must be directly on the Enforce server.

D.

The OCR server software must be installed on one or more dedicated (non-detection) Windows servers.

Question 8

What is the correct order for data in motion when a customer has integrated their CloudSOC and DLP solutions?

Options:

A.

User > CloudSOC Gatelet > DLP Cloud Detection Service > Application

B.

User > Enforce > Application

C.

User > Enforce > CloudSOC > Application

D.

User > CloudSOC Gatelet > Enforce > Application

Question 9

Which two (2) DLP products support Optical Character Recognition (OCR)? (Choose two.)

Options:

A.

Network Discover

B.

Endpoint Prevent

C.

Network Prevent for Email

D.

Endpoint Discover

E.

Information Centric Analytics

Question 10

A customer needs to integrate information form DLP incidents into external Governance, Risk, and Compliance dashboards.

Which feature should a third-party component integrate with to provide dynamic reporting, create custom incident remediation processes, or support business processes?

Options:

A.

Incident Reporting and Update API

B.

Export incidents using the CSV format

C.

A web incident extraction report

D.

Incident Data Views

Question 11

What should an incident responder select in the Enforce management console to remediate multiple incidents simultaneously?

Options:

A.

Smart Response on the Incident Snapshot page

B.

Automated Response on an Incident List report

C.

Smart Response on an Incident List report

D.

Automated Response on the Incident Snapshot page

Question 12

Which tool must a DLP administrator run to certify the database prior to upgrading DLP?

Options:

A.

Enforce Migration Utility

B.

SymDiag

C.

Upgrade Readiness Tool

D.

Lob_Tablespace Reclamation Tool

Question 13

When configuring Network Prevent for Email, what is the role of Mail Transfer Agents (MTAs)?

Options:

A.

To secure web browsers

B.

To monitor general network traffic

C.

To capture and inspect email traffic

D.

To manage network firewalls

Question 14

A company needs to implement Data Owner Exception so that incidents when employees send or receive their own personal information.

What detection method should the company use?

Options:

A.

Indexed Document Matching (IDM)

B.

Vector Machine Learning (VML)

C.

Exact data matching (EDM)

D.

Described Content matching (DCM)

Question 15

A DLP administrator is testing Network Prevent for Web functionality. When the administrator posts a small test file to a cloud storage website, no new incidents are reported.

What should the administrator do to allow incidents to be generated against this file?

Options:

A.

Change the “Ignore requests Smaller Than” value to 1

B.

Add the filename to the Inspect Content Type field

C.

Change the “PacketCapture.DISCARD_HTTP_GET” value to “false”

D.

Uncheck trial mode under the ICAP tab

Question 16

Which two locations can Symantec DLP scan and perform Information Centric Encryption (ICE) actions on? (Choose two.)

Options:

A.

Exchange

B.

Jiveon

C.

File store

D.

SharePoint

E.

Confluence

Question 17

When Symantec DLP and Symantec CloudSOC are integrated, what must you configure in Enforce to tell CloudSOC which traffic or content to send to the Cloud Detection Service for analysis?

Options:

A.

DLP policies with CloudSOC-specific detection rules and response rules

B.

Cloud Detection Service traffic settings on the Servers and Detectors Overview page

C.

Traffic settings in the Agent Configuration for endpoint computers running the WSS Agent

D.

One or more Application Detection Configurations that include Gatelet and Securlet settings

Question 18

Which two components can perform a file system scan of a workstation? (Choose two.)

Options:

A.

Endpoint Server

B.

DLP Agent

C.

Network Prevent for Web Server

D.

Discover Server

E.

Enforce Server

Question 19

A DLP administrator needs to remove an agent its associated events from an Endpoint server.

Which Agent Task should the administrator perform to disable the agent’s visibility in the Enforce management console?

Options:

A.

Delete action from the Agent health dashboard

B.

Delete action from the Agent List page

C.

Disable action from Symantec Management Console

D.

Change endpoint Server action from the Agent Overview page

Question 20

Which server target uses the “Automated Incident Remediation Tracking” feature in Symantec DLP?

Options:

A.

File System High-Speed Discovery

B.

File System (standard)

C.

SharePoint

D.

Exchange

Question 21

What detection technology supports partial row matching?

Options:

A.

Vector Machine Learning (VML)

B.

Indexed Document Matching (IDM)

C.

described Content Matching (EDM)

D.

Exact data Matching (EDM)

Question 22

Which action should a DLP administrator take to secure communications between an on-premises Enforce server and detection servers hosted in the Cloud?

Options:

A.

Use the built-in Symantec DLP certificate for the Enforce Server, and use the “sslkeytool” utility to create certificates for the detection servers.

B.

Use the built-in Symantec DLP certificate for both the Enforce server and the hosted detection servers.

C.

Set up a Virtual Private Network (VPN) for the Enforce server and the hosted detection servers.

D.

Use the “sslkeytool” utility to create certificates for the Enforce server and the hosted detection servers.

Question 23

Which network Prevent action takes place when the network Incident list shows the message is “Modified”?

Options:

A.

Remove attachments from an email

B.

Obfuscate text in the body of an email

C.

Add one or more SMTP headers to an email

D.

Modify content from the body of an email

Question 24

What is Application Detection Configuration?

Options:

A.

The Cloud Detection Service (CDS) process that tells Enforce a policy has been violated

B.

The Data Loss Prevention (DLP) policy which has been pushed into Cloud Detection Service (CDC) for files in transit to or residing in Cloud apps

C.

The terminology describing the Data Loss Prevention (DLP) process within the CloudSOC administration portal

D.

the setting configured within the user interface (UI) that determines whether CloudSOC should send a file to Cloud Detection Service (CDS) for analysis.

Question 25

A software company wants to protect its source code, including new source code created between scheduled indexing runs.

Which detection method should the company use to meet this requirement?

Options:

A.

Exact Data Matching (EDM)

B.

Described Content Matching (DCM)

C.

Vector Machine Learning (VML)

D.

Indexed Document Matching (IDM)

Question 26

Which two actions are available for a “Network Prevent: Remove HTTP/HTTPS content” response rule when the content is unable to be removed? (Choose two.)

Options:

A.

Allow the content to be posted

B.

Remove the content through FlexResponse

C.

Block the content before posting

D.

Encrypt the content before posting

E.

Redirect the content to an alternative destination

Question 27

A DLP administrator has performed a test deployment of the DLP 15.0 Endpoint agent and now wants to uninstall the agent. However, the administrator no longer remembers the uninstall password.

What should the administrator do to work around the password problem?

Options:

A.

Apply a new global agent uninstall password in the Enforce management console.

B.

Manually delete all the Endpoint agent files from the test computer and install a new agent package.

C.

Replace the PGPsdk.dll file on the agent’s assigned Endpoint server with a copy from a different Endpoint server

D.

Use the UninstallPwdGenerator to create an UninstallPasswordKey.

Question 28

An organization wants to restrict employees to copy files only a specific set of USB thumb drives owned by the organization.

Which detection method should the organization use to meet this requirement?

Options:

A.

Exact data Matching (EDM)

B.

Indexed Document matching (IDM)

C.

Described Content Matching (DCM)

D.

Vector Machine Learning (VML)

Question 29

What is required on the Enforce server to communicate with the Symantec DLP database?

Options:

A.

Port 8082 should be opened

B.

CryptoMasterKey.properties file

C.

Symbolic links to .dbf files

D.

SQL*plus Client

Question 30

Why would an administrator set the Similarity Threshold to s=zero when testing and tuning a Vector Machine Learning (VML) profile?

Options:

A.

To capture the matches to the Positive set

B.

To capture the matches to the negative set

C.

To see the false negatives only

D.

To see the entire range of potential matches

Question 31

Which network DLP products support User Risk-Based Detection, in which Symantec DLP uses Symantec Information Centric Analytics (ICA) user risk scores in policy detection rules?

Options:

A.

Network Prevent for Email only

B.

Network Prevent for Web only

C.

Network Prevent for Email and Network Prevent for Web only

D.

Network Monitor, Network Prevent for Email, and Network Prevent for Web

Question 32

What is the first step an administrator should take to improve the performance of Network Monitor when network traffic exceeds 1 Gbps?

Options:

A.

Increase system memory (RAM) for existing Network Prevent servers.

B.

Add more Network Prevent servers to the Symantec DLP environment.

C.

Filter out all network traffic that is unreadable to Network Monitor.

D.

Install network taps and connect them to existing Network Monitor servers.

Demo: 32 questions
Total 108 questions