250-587 Exam Training Practice Tests (Symantec Data Loss Prevention 16.x Administration Technical Specialist)]

Question 1

Which two components can perform a file system scan of a workstation? (Choose two.)

A. Discover Server B. DLP Agent C. Endpoint Server D. Network Prevent for Web Server E. Enforce Server

Correct Answer: A,B

Question 2

Which two actions are available for a "Network Prevent: Remove HTTP/HTTPS content" response rule when the content is unable to be removed? (Choose two.)

A. Remove the content through FlexResponse B. Allow the content to be posted C. Redirect the content to an alternative destination D. Block the content before posting E. Encrypt the content before posting

Correct Answer: B,C

Question 3

Which tool must a DLP administrator run to certify the database prior to upgrading DLP?

A. SymDiag B. EnforceMigrationUtility C. Lob_Tablespace Reclamation Tool D. Upgrade Readiness Tool

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

A DLP administrator is attempting to add a new Network Discover detection server from the Enforce management console. However, the only available options are Network Monitor and Endpoint servers.
What should the administrator do to make the Network Discover option available?

A. Apply a new software license file from the Enforce console B. Restart the Vontu Monitor Service C. Restart the Symantec DLP Controller service D. Install a new Network Discover detection server

Correct Answer: D

Question 5

Which two Network Discover/Cloud Storage targets apply Information Centric Encryption as policy response rules?

A. SQL Databases B. Microsoft Exchange C. Network File System (NFS) D. Microsoft SharePoint E. Windows File System

Correct Answer: B,D

Question 6

When managing an Endpoint Discover scan, a DLP administrator notices some endpoint computers are NOT completing their scans.
When does the DLP agent stop scanning?

A. When the agent sends a report within the "Scan Idle Timeout" period B. When the agent is unable to send a status report within the "Scan Idle Timeout" period C. When the agent sends a report immediately after the "Scan Idle Timeout" period D. When the endpoint computer is rebooted and the agent is started

Correct Answer: B

Question 7

A DLP administrator determines that the \SymantecDLP\Protect\Incidents folder on the Enforce server contains. BAD files dated today, while other. IDC files are flowing in and out of the \Incidents directory.
Only .IDC files larger than 1MB are turning to .BAD files.
What could be causing only incident data smaller than 1MB to persist while incidents larger than 1MB change to .BAD files?

A. A corrupted policy was deployed. B. The Enforce server's hard drive is out of space. C. A detection server has excessive filereader restarts. D. Tablespace is almost full.

Correct Answer: D

Question 8

What is required on the Enforce server to communicate with the Symantec DLP database?

A. Port 8082 should be opened B. Symbolic links to .dbf files C. SQL*plus Client D. CryptoMasterKey.properties file

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Symantec Data Loss Prevention 16.x Administration Technical Specialist - 250-587 Exam Practice Test