Symantec Data Loss Prevention 16.x Administration Technical Specialist (250-587) Free Practice Test

Question 1

What are two (2) reasons an administrator should utilize a manual configuration to determine the endpoint location? (Choose two.)

A. To specify domain names

B. To specify network card status (ON/OFF)

C. To specify an IP address or range

D. To specify Wi-Fi SSID names

E. To specify the endpoint server

Correct Answer: C,D

Question 2

Which two (2) detection technology options run ONLY on detection servers and NOT on endpoint agents?
(Choose two.)

A. Indexed Document Matching (IDM)

B. Exact Data Matching (EDM)

C. Described Content Matching (DCM)

D. Vector Machine Learning (VML)

E. Form Recognition

Correct Answer: D,E

Question 3

A DLP administrator has enabled and successfully tested custom attribute lookups for incident data based on the Active Directory LDAP plugin. The Chief Information Security Officer (CISO) has attempted to generate a User Risk Summary report, but the report is empty. The DLP administrator confirms the Cisco's role has the
"User Reporting" privilege enabled, but User Risk reporting is still not working.
What is the probable reason that the User Risk Summary report is blank?

A. The Enforce server has insufficient permissions for importing user attributes.

B. User attributes have been incorrectly mapped to Active Directory accounts.

C. Only DLP administrators are permitted to access and view data for high risk users.

D. User attribute data must be configured separately from incident data attributed.

Correct Answer: B

Question 4

Which action is available for use in both Smart Response and Automated Response rules?

A. Block email message

B. Log to a Syslog Server

C. Modify SMTP message

D. Limit incident data retention

Correct Answer: A

Question 5

A DLP administrator is checking the System Overview in the Enforce management console, and all of the detection servers are showing as "unknown". The Vontu services are up and running on the detection servers.
Thousands of .IDC files are building up in the Incidents directory on the detection servers. There is good network connectivity between the detection servers and the Enforce server when testing with the telnet command.
How should the administrator bring the detection servers to a running state in the Enforce management console?

A. Restart the Vontu Monitor Service on all the affected detection servers

B. Ensure the Vontu Monitor Controller service is running in the Enforce server

C. Restart the Vontu Update Service on the Enforce server

D. Delete all of the .BAD files in the Incidents folder on the Enforce server

Correct Answer: B

Question 6

Which two Infrastructure-as-a-Service providers are supported for hosting Cloud Prevent for Office 365?
(Choose two.)

A. Rackspace

B. Any customer-hosted private cloud

C. Verizon

D. AT & T

E. Amazon Web Services

Correct Answer: A,E

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

What is one difference between Exact Data Matching (EDM) and Exact Match Data Identifiers (EMDI)?

A. EDM requires an index and EMDI does not.

B. EDM rules can be evaluated by the DLP Agent and EMDI rules cannot.

C. EDM is its own detection rule type and EMDI is a Data Identifier validation check.

D. EDM is better at detecting non-standard delimiters (in ID numbers) than EMDI.

Correct Answer: C

Question 8

Which two (2) DLP products support Optical Character Recognition (OCR)? (Choose two.)

A. Network Discover

B. Endpoint Discover

C. Network Prevent for Email

D. Endpoint Prevent

E. Information Centric Analytics

Correct Answer: B,C

Welcome to TestSimulate

Symantec Data Loss Prevention 16.x Administration Technical Specialist (250-587) Free Practice Test