Summer Sale - Special 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70dumps

250-587 Questions and Answers

Question # 6

What is the Symantec recommended order for stopping Symantec DLP services on a Windows Enforce server?

A.

Vontu Notifier, Vontu Incident Persister, Vontu Update, Vontu Manager, Vontu Monitor Controller

B.

Vontu Update, Vontu Notifier, Vontu Manager, Vontu Incident Persister, Vontu Monitor Controller

C.

Vontu Incident Persister, Vontu Update, Vontu Notifier, Vontu Monitor Controller, Vontu Manager.

D.

Vontu Monitor Controller, Vontu Incident Persister, Vontu Manager, Vontu Notifier, Vontu Update.

Full Access
Question # 7

A company needs to secure the content of all mergers and Acquisitions Agreements/ However, the standard text included in all company literature needs to be excluded.

How should the company ensure that this standard text is excluded from detection?

A.

Create a Whitelisted.txt file after creating the Vector Machine Learning (VML) profile.

B.

Create a Whitelisted.txt file after creating the Exact Data Matching (EDM) profile

C.

Create a Whitelisted.txt file before creating the Indexed Document Matching (IDM) profile

D.

Create a Whitelisted.txt file before creating the Exact Data Matching (EDM) profile

Full Access
Question # 8

Which two detection technology options ONLY run on a detection server? (Choose two.)

A.

Form Recognition

B.

Indexed Document matching (IDM)

C.

Described Content Matching (DCM)

D.

Exact data matching (EDM)

E.

vector Machine Learning (VML)

Full Access
Question # 9

What are two reasons an administrator should utilize a manual configuration to determine the endpoint location? (Choose two.)

A.

To specify Wi-Fi SSID names

B.

To specify an IP address or range

C.

To specify the endpoint server

D.

To specify domain names

E.

To specify network card status (ON/OFF)

Full Access
Question # 10

A DLP administrator is attempting to add a new Network Discover detection server from the Enforce management console. However, the only available options are Network Monitor and Endpoint servers.

What should the administrator do to make the Network Discover option available?

A.

Restart the Symantec DLP Controller service

B.

Apply a new software license file from the Enforce console

C.

Install a new Network Discover detection server

D.

Restart the Vontu Monitor Service

Full Access
Question # 11

Where in the Enforce management console can a DLP administrator change the “UI.NO_SCAN.int” setting to disable the “Inspecting data” pop-up?

A.

Advanced Server Settings from the Endpoint Server Configuration

B.

Advanced Monitoring from the Agent Configuration

C.

Advanced Agent Settings from the Agent Configuration

D.

Application Monitoring from the Agent Configuration

Full Access
Question # 12

A DLP administrator needs to stop the PacketCapture process on a detection server. Upon inspection of the Server Detail page, the administrator discovers that all processes are missing from the display.

What are the processes missing from the Server Detail page display?

A.

The detection server Display Control Process option is disabled on the Server Detail page.

B.

The Display Process Control setting on the Advanced Settings page is disabled.

C.

The detection server PacketCapture process is displayed on the Server Overview page.

D.

The Advanced Process Control setting on the System Settings page is deselected.

Full Access
Question # 13

Which action is available for use in both Smart Response and Automated Response rules?

A.

Log to a Syslog Server

B.

Limit incident data retention

C.

Modify SMTP message

D.

Block email message

Full Access
Question # 14

Which tool must a DLP administrator run to certify the database prior to upgrading DLP?

A.

Enforce Migration Utility

B.

SymDiag

C.

Upgrade Readiness Tool

D.

Lob_Tablespace Reclamation Tool

Full Access
Question # 15

A DLP administrator is checking the System Overview in the Enforce management console, and all of the detection servers are showing as “unknown”. The Vontu services are up and running on the detection servers. Thousands of .IDC files are building up in the Incidents directory on the detection servers. There is good network connectivity between the detection servers and the Enforce server when testing with the telnet command.

How should the administrator bring the detection servers to a running state in the Enforce management console?

A.

Restart the Vontu Update Service on the Enforce server

B.

Ensure the Vontu Monitor Controller service is running in the Enforce server

C.

Delete all of the .BAD files in the Incidents folder on the Enforce server

D.

Restart the Vontu Monitor Service on all the affected detection servers

Full Access
Question # 16

A software company wants to protect its source code, including new source code created between scheduled indexing runs.

Which detection method should the company use to meet this requirement?

A.

Exact Data Matching (EDM)

B.

Described Content Matching (DCM)

C.

Vector Machine Learning (VML)

D.

Indexed Document Matching (IDM)

Full Access
Question # 17

How do Cloud Detection Service and the Enforce server communicate with each other?

A.

Enforce initiates communication with Cloud Detection Service, which is expecting connections on port 8100.

B.

Cloud Detection Service initiates communication with Enforce, which is expecting connections on port 443.

C.

Cloud Detection Service initiates communication with Enforce, which is expecting connections on port 1443.

D.

Enforce initiates communication with Cloud Detection Service, which is expecting connections on port 443.

Full Access
Question # 18

When managing an Endpoint Discover scan, a DLP administrator notices some endpoint computers are NOT completing their scans.

When does the DLP agent stop scanning?

A.

When the agent sends a report within the “Scan Idle Timeout” period

B.

When the endpoint computer is rebooted and the agent is started

C.

When the agent is unable to send a status report within the “Scan Idle Timeout” period

D.

When the agent sends a report immediately after the “Scan Idle Timeout” period

Full Access
Question # 19

Which two (2) detection technology options run ONLY on detection servers and NOT on endpoint agents? (Choose two.)

A.

Indexed Document Matching (IDM)

B.

Vector Machine Learning (VML)

C.

Described Content Matching (DCM)

D.

Exact Data Matching (EDM)

E.

Form Recognition

Full Access
Question # 20

Which detection method is best suited for identifying sensitive content within scanned images or image-based PDF files?

A.

Keyword-Based Detection

B.

Optical Character Recognition (OCR)

C.

Regular Expression Matching

D.

Exact Data Matching (EDM)

Full Access
Question # 21

Which two detection technology options run on the DLP agent? (Choose two.)

A.

Optical Character Recognition (OCR)

B.

Described Content Matching (DCM)

C.

Directory Group Matching (DGM)

D.

Form Recognition

E.

Indexed Document Matching (IDM)

Full Access
Question # 22

What detection server is used for Network Discover, Network Protect, and Cloud Storage?

A.

Network Protect Storage Discover

B.

Network Discover/Cloud Storage Discover

C.

Network Prevent/Cloud Detection Service

D.

Network Protect/Cloud Detection Service

Full Access
Question # 23

Which Network Prevent action has taken place when a Network incident snapshot indicates the message has been “Modified”?

A.

Modify content from the body of an email

B.

Add one or more SMTP headers to an email

C.

Obfuscate text in the body of an email

D.

Remove attachments from an email

Full Access
Question # 24

Which option is an accurate use case for Information Centric Encryption (ICE)?

A.

The ICE utility encrypts files matching DLP policy being copied from network share through use of encryption keys.

B.

The ICE utility encrypts files matching DLP policy being copied to removable storage through use of encryption keys.

C.

The ICE utility encrypts files matching DLP policy being copied to removable storage on an endpoint use of certificates.

D.

The ICE utility encrypts files matching DLP policy being copied from network share through use of certificates

Full Access
Question # 25

A DLP administrator created a new agent configuration for an Endpoint server. However, the endpoint agents fail to receive the new configuration.

What is one possible reason that the agent fails to receive the new configuration?

A.

The default agent configuration must be disabled before the new configuration can be assigned.

B.

The Endpoint server needs to be recycled so that the new agent configuration can take effect.

C.

The new agent configuration was saved but not applied to any endpoint groups.

D.

The new agent configuration was copied and modified from the default agent configuration.

Full Access
Question # 26

Refer to the exhibit.

Question # 26

What activity should occur during the baseline phase, according to the risk reduction model?

A.

Define and build the incident response team

B.

Monitor incidents and tune the policy to reduce false positives

C.

Establish business metrics and begin sending reports to business unit stakeholders

D.

Test policies to ensure that blocking actions minimize business process disruptions

Full Access
Question # 27

Which action should a DLP administrator take to secure communications between an on-premises Enforce server and detection servers hosted in the Cloud?

A.

Use the built-in Symantec DLP certificate for the Enforce Server, and use the “sslkeytool” utility to create certificates for the detection servers.

B.

Use the built-in Symantec DLP certificate for both the Enforce server and the hosted detection servers.

C.

Set up a Virtual Private Network (VPN) for the Enforce server and the hosted detection servers.

D.

Use the “sslkeytool” utility to create certificates for the Enforce server and the hosted detection servers.

Full Access
Question # 28

Which of the following would have to be a custom attribute (and not an out-of -the-box system attribute) in incident snapshots?

A.

Network Prevent Action

B.

Endpoint Location

C.

Employee Phone Number

D.

See Before

Full Access
Question # 29

What are three features that are available for Network Discover File System High-Speed Discover (FS-HSD) scans but are NOT available for Network Discover (regular or legacy) File System scans?

A.

Support for SMB v3, Symantec DLP REST APIs, and Internal Pause-Resume

B.

Support for SMB v3, Symantec DLP REST APIs, and incremental scans

C.

Symantec DLP REST APIs, incremental scans, and scan scheduling

D.

Incremental scans, scan scheduling, and incident replication scan status

Full Access
Question # 30

What is the correct order for data in motion when a customer has integrated their CloudSOC and DLP solutions?

A.

User > CloudSOC Gatelet > DLP Cloud Detection Service > Application

B.

User > Enforce > Application

C.

User > Enforce > CloudSOC > Application

D.

User > CloudSOC Gatelet > Enforce > Application

Full Access
Question # 31

Which server target uses the “Automated Incident Remediation Tracking” feature in Symantec DLP?

A.

File System High-Speed Discovery

B.

File System (standard)

C.

SharePoint

D.

Exchange

Full Access
Question # 32

An administrator is unable to log in to the Enforce management console as “sysadmin”. Symantec DLP is configured to use Active Directory authentication. The administrator is a member of two roles: “sysadmin” and “remediator.”

How should the administrator log in to the Enforce console with the “sysadmin” role?

A.

sysadmin\username

B.

sysadmin\username@domain

C.

domain\username

D.

username\sysadmin

Full Access