Summer Certification Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

Free and Premium Symantec 250-587 Dumps Questions Answers

Page: 1 / 8
Total 108 questions

Symantec Data Loss Prevention 16.x Administration Technical Specialist Questions and Answers

Question 1

Which server target uses the “Automated Incident Remediation Tracking” feature in Symantec DLP?

Options:

A.

File System High-Speed Discovery

B.

File System (standard)

C.

SharePoint

D.

Exchange

Buy Now
Question 2

When troubleshooting Enforce issues, what should be considered regarding server resources?

Options:

A.

Server resources have no impact on DLP performance.

B.

Server resource allocation may affect DLP system performance.

C.

Server resources affect only DLP Agent functionality.

D.

Server resources are managed automatically by DLP.

Question 3

Which Network Prevent action has taken place when a Network incident snapshot indicates the message has been “Modified”?

Options:

A.

Modify content from the body of an email

B.

Add one or more SMTP headers to an email

C.

Obfuscate text in the body of an email

D.

Remove attachments from an email

Question 4

Which two (2) detection technology options run ONLY on detection servers and NOT on endpoint agents? (Choose two.)

Options:

A.

Indexed Document Matching (IDM)

B.

Vector Machine Learning (VML)

C.

Described Content Matching (DCM)

D.

Exact Data Matching (EDM)

E.

Form Recognition

Question 5

A DLP administrator is checking the System Overview in the Enforce management console, and all of the detection servers are showing as “unknown”. The Vontu services are up and running on the detection servers. Thousands of .IDC files are building up in the Incidents directory on the detection servers. There is good network connectivity between the detection servers and the Enforce server when testing with the telnet command.

How should the administrator bring the detection servers to a running state in the Enforce management console?

Options:

A.

Restart the Vontu Update Service on the Enforce server

B.

Ensure the Vontu Monitor Controller service is running in the Enforce server

C.

Delete all of the .BAD files in the Incidents folder on the Enforce server

D.

Restart the Vontu Monitor Service on all the affected detection servers

Question 6

Which two factors are common sources of data leakage where the main actor is well-meaning insider? (Choose two.)

Options:

A.

An absence of a trained incident response team

B.

A disgruntled employee for a job with a competitor

C.

Merger and Acquisition activities

D.

Lack of training and awareness

E.

Broken business processes

Question 7

What should an administrator do if DLP policies are generating too many false positives?

Options:

A.

Ignore incident reports until a critical issue arises.

B.

Disable all policies temporarily.

C.

Allow users to approve exceptions manually.

D.

Refine detection methods, such as Exact Data Matching (EDM) and fingerprinting.

Question 8

The Symantec Data Loss risk reduction approach has six stages.

Drag and drop the six correct risk reduction stages in the proper order of Occurrence column.

Options:

Question 9

Refer to the exhibit. Which type of Endpoint response rule is shown?

Options:

A.

Endpoint Prevent: User Notification

B.

Endpoint Prevent: Block

C.

Endpoint Prevent: Notify

D.

Endpoint Prevent: User Cancel

Question 10

What detection server type requires a minimum of two physical network interface cards?

Options:

A.

Network Prevent for Web

B.

Network Prevent for Email

C.

Network Monitor

D.

Cloud Detection Service (CDS)

Question 11

Which detection server is available from Symantec as a hardware appliance?

Options:

A.

Network Prevent for Email

B.

Network Discover

C.

Network Monitor

D.

Network Prevent for Web

Question 12

How do Cloud Detection Service and the Enforce server communicate with each other?

Options:

A.

Enforce initiates communication with Cloud Detection Service, which is expecting connections on port 8100.

B.

Cloud Detection Service initiates communication with Enforce, which is expecting connections on port 443.

C.

Cloud Detection Service initiates communication with Enforce, which is expecting connections on port 1443.

D.

Enforce initiates communication with Cloud Detection Service, which is expecting connections on port 443.

Question 13

Which two DLP products support the new Optical Character Recognition (OCR) engine in Symantec DLP 15.0? (Choose two.)

Options:

A.

Endpoint Prevent

B.

Cloud Service for Email

C.

Network Prevent for Email

D.

Network Discover

E.

Cloud Detection Service

Question 14

Which type of response rule does Cloud Service for Email use to block confidential emails?

Options:

A.

Network Prevent: Block HTTP/HTTPS

B.

Network Prevent: Block SMTP Message

C.

Cloud Applications and API Appliance: Block Data-in-Motion

D.

Cloud Applications and API Appliance: Redact Data-in-Motion

Question 15

Which two (2) technologies should an organization utilize for integration with the Network Prevent products? (Choose two.)

Options:

A.

Mail Transfer Agent

B.

Network Tap

C.

Proxy Server

D.

Network Firewall

E.

Encryption Appliance

Question 16

Which tool must a DLP administrator run to certify the database prior to upgrading DLP?

Options:

A.

Enforce Migration Utility

B.

SymDiag

C.

Upgrade Readiness Tool

D.

Lob_Tablespace Reclamation Tool

Question 17

What detection technology supports partial contents matching?

Options:

A.

Indexed Document Matching (IDM)

B.

Described Content Matching (DCM)

C.

Exact Data Matching (DCM)

D.

Optical Character Recognition (OCR)

Question 18

What is the default fallback option for the Endpoint Prevent Encrypt response rule?

Options:

A.

Block

B.

User Cancel

C.

Encrypt

D.

Notify

Question 19

A customer needs to integrate information from DLP incidents into external Governance, Risk and Compliance dashboards.

Which feature should a third party component integrate with to provide dynamic reporting, create custom incident remediation processes, or support business processes?

Options:

A.

Export incidents using the CSV format

B.

Incident Reporting and Update API

C.

Incident Data Views

D.

A Web incident extraction report

Question 20

Which server target uses the “Automated Incident Remediation Tracking” feature in Symantec DLP?

Options:

A.

Exchange

B.

File System

C.

Lotus Notes

D.

SharePoint

Question 21

When Symantec DLP is integrated with Microsoft Purview Information Protection (MPIP, also previously known as MIP), to which content types can the Mac DLP Agent apply MPIP labels (classification tags)?

Options:

A.

Microsoft Word, Excel, and PowerPoint files

B.

Microsoft Word, Excel, and PowerPoint files; and Adobe PDF files

C.

Microsoft Word, Excel, and PowerPoint files; and Microsoft Outlook emails

D.

Microsoft Word, Excel, and PowerPoint files; Microsoft Outlook emails; and Adobe PDF files

Question 22

A DLP administrator is preparing to install Symantec DLP and has been asked to use an Oracle database provided by the Database Administration team.

Which SQL *Plus command should the administrator utilize to determine if the database is using a supported version of Oracle?

Options:

A.

select database version from < database name > ;

B.

select * from db$version;

C.

select * from v$version;

D.

select db$ver from < database name > ;

Question 23

Which type of detector integrates with Symantec CloudSOC?

Options:

A.

Cloud Detection Service for REST

B.

Cloud Detection Service for ICAP

C.

Cloud Detection Service for SMTP

D.

Cloud Prevent detector

Question 24

What should an incident responder select in the Enforce management console to remediate multiple incidents simultaneously?

Options:

A.

Smart response on the Incident page

B.

Automated Response on the Incident Snapshot page

C.

Smart response on an Incident List report

D.

Automated response on an Incident List report

Question 25

A DLP administrator determines that the \SymantecDLP\Protect\Incidents folder on the Enforce server contains. BAD files dated today, while other. IDC files are flowing in and out of the \Incidents directory. Only .IDC files larger than 1MB are turning to .BAD files.

What could be causing only incident data smaller than 1MB to persist while incidents larger than 1MB change to .BAD files?

Options:

A.

A corrupted policy was deployed.

B.

The Enforce server’s hard drive is out of space.

C.

A detection server has excessive filereader restarts.

D.

Tablespace is almost full.

Question 26

Which two technologies should an organization utilize for integration with the Network Prevent products? (choose two.)

Options:

A.

Network Tap

B.

Network Firewall

C.

Proxy Server

D.

Mail Transfer Agent

E.

Encryption Appliance

Question 27

A DLP administrator has enabled and successfully tested custom attribute lookups for incident data based on the Active Directory LDAP plugin. The Chief Information Security Officer (CISO) has attempted to generate a User Risk Summary report, but the report is empty. The DLP administrator confirms the Cisco’s role has the “User Reporting” privilege enabled, but User Risk reporting is still not working.

What is the probable reason that the User Risk Summary report is blank?

Options:

A.

Only DLP administrators are permitted to access and view data for high risk users.

B.

The Enforce server has insufficient permissions for importing user attributes.

C.

User attribute data must be configured separately from incident data attributed.

D.

User attributes have been incorrectly mapped to Active Directory accounts.

Question 28

Which service encrypts the message when using a Modify SMTP Message response rule?

Options:

A.

Network Monitor server

B.

SMTP Prevent

C.

Enforce server

D.

Encryption Gateway

Question 29

Which network DLP products support User Risk-Based Detection, in which Symantec DLP uses Symantec Information Centric Analytics (ICA) user risk scores in policy detection rules?

Options:

A.

Network Prevent for Email only

B.

Network Prevent for Web only

C.

Network Prevent for Email and Network Prevent for Web only

D.

Network Monitor, Network Prevent for Email, and Network Prevent for Web

Question 30

Which two Infrastructure-as-a-Service providers are supported for hosting Cloud Prevent for Office 365? (Choose two.)

Options:

A.

Any customer-hosted private cloud

B.

Amazon Web Services

C.

AT & T

D.

Verizon

E.

Rackspace

Question 31

Which two (2) actions are available for a “Network Prevent: Remove HTTP/HTTPS content” response rule when the content is unable to be removed? (Choose two.)

Options:

A.

Redirect the content to an alternative destination

B.

Block the content from being posted

C.

Encrypt the content before posting

D.

Remove the content through FlexResponse

E.

Allow the content to be posted

Question 32

Which tool must a DLP administrator run to certify the database prior to upgrading DLP?

Options:

A.

Lob_Tablespace Reclamation Tool

B.

Upgrade Readiness Tool

C.

SymDiag

D.

EnforceMigrationUtility

Page: 1 / 8
Total 108 questions