Symantec Data Loss Prevention 16.x Administration Technical Specialist

QUESTION NO: 1
Which of the following would have to be a custom attribute (and not an out-of -the-box system attribute) in incident snapshots?

A. See Before B. Endpoint Location C. Network Prevent Action D. Employee Phone Number

Correct Answer: D

QUESTION NO: 2
Which two Infrastructure-as-a-Service providers are supported for hosting Cloud Prevent for Office 365?
(Choose two.)

A. Rackspace B. AT & T C. Verizon D. Amazon Web Services E. Any customer-hosted private cloud

Correct Answer: A,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
Which two (2) detection technology options run on the DLP agent? (Choose two.)

A. Directory Group Matching (DGM) B. Indexed Document Matching (IDM) C. Optical Character Recognition (OCR) D. Form Recognition E. Described Content Matching (DCM)

Correct Answer: B,E

QUESTION NO: 4
A DLP administrator needs to stop the PacketCapture process on a detection server. Upon inspection of the Server Detail page, the administrator discovers that all processes are missing from the display.
What are the processes missing from the Server Detail page display?

A. The Display Process Control setting on the Advanced Settings page is disabled. B. The detection server Display Control Process option is disabled on the Server Detail page. C. The Advanced Process Control setting on the System Settings page is deselected. D. The detection server PacketCapture process is displayed on the Server Overview page.

Correct Answer: A

QUESTION NO: 5
How should a DLP administrator change a policy that it retains the original file when an endpoint incident has detected a "copy to USB device" operation?

A. Modify the agent configuration and select the option "Retain Original Files" B. Modify the "Endpoint_Retain_Files.int" setting in the Endpoint server configuration C. Modify the agent config.db to include the file D. Add a "Limit Incident Data Retention" response rule with "Retain Original Message" option selected

Correct Answer: A

QUESTION NO: 6
Where in the Enforce management console can a DLP administrator change the "UI.NO_SCAN.int" setting to disable the "Inspecting data" pop-up?

A. Advanced Agent Settings from the Agent Configuration B. Application Monitoring from the Agent Configuration C. Advanced Server Settings from the Endpoint Server Configuration D. Advanced Monitoring from the Agent Configuration

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
Which option is an accurate use case for Information Centric Encryption (ICE)?

A. The ICE utility encrypts files matching DLP policy being copied to removable storage on an endpoint use of certificates. B. The ICE utility encrypts files matching DLP policy being copied to removable storage through use of encryption keys. C. The ICE utility encrypts files matching DLP policy being copied from network share through use of certificates D. The ICE utility encrypts files matching DLP policy being copied from network share through use of encryption keys.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
Which two DLP products support the new Optical Character Recognition (OCR) engine in Symantec DLP
15.0? (Choose two.)

A. Network Discover B. Cloud Service for Email C. Endpoint Prevent D. Cloud Detection Service E. Network Prevent for Email

Correct Answer: B,E

QUESTION NO: 9
Which two detection technology options ONLY run on a detection server? (Choose two.)

A. Indexed Document matching (IDM) B. Exact data matching (EDM) C. vector Machine Learning (VML) D. Form Recognition E. Described Content Matching (DCM)

Correct Answer: A,B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

Symantec Data Loss Prevention 16.x Administration Technical Specialist - 250-587 Exam Questions