Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Symantec
Data Loss Prevention
250-587
Symantec Data Loss Prevention 16.x Administration Technical Specialist Questions and Answers

Pass the Symantec Data Loss Prevention 250-587 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam 250-587 Premium Access

View all detail and faqs for the 250-587 exam

Go to Exam

621 Students Passed

84% Average Score

96% Same Questions

Viewing page 4 out of 4 pages

Viewing questions 31-40 out of questions

Questions # 31:

What is required on the Enforce server to communicate with the Symantec DLP database?

Options:

Port 8082 should be opened

CryptoMasterKey.properties file

Symbolic links to .dbf files

SQL*plus Client

Answer

Explanation

[References:, , ]

Questions # 32:

A DLP administrator needs to stop the PacketCapture process on a detection server. Upon inspection of the Server Detail page, the administrator discovers that all processes are missing from the display.

What are the processes missing from the Server Detail page display?

Options:

The detection server Display Control Process option is disabled on the Server Detail page.

The Display Process Control setting on the Advanced Settings page is disabled.

The detection server PacketCapture process is displayed on the Server Overview page.

The Advanced Process Control setting on the System Settings page is deselected.

Answer

Questions # 33:

Refer to the exhibit.

Question # 33

What activity should occur during the baseline phase, according to the risk reduction model?

Options:

Define and build the incident response team

Monitor incidents and tune the policy to reduce false positives

Establish business metrics and begin sending reports to business unit stakeholders

Test policies to ensure that blocking actions minimize business process disruptions

Answer

Questions # 34:

Which detection server is available from Symantec as a hardware appliance?

Options:

Network Prevent for Email

Network Discover

Network Monitor

Network Prevent for Web

Answer

Explanation

[References:, , ]

Questions # 35:

When troubleshooting Enforce issues, what should be considered regarding server resources?

Options:

Server resources have no impact on DLP performance.

Server resource allocation may affect DLP system performance.

Server resources affect only DLP Agent functionality.

Server resources are managed automatically by DLP.

Answer

Explanation

Enforce performance depends directly on the resources allocated to the server and its supporting database. CPU availability, memory, disk capacity, disk latency, network connectivity, and database resources can affect console responsiveness, incident persistence, reporting, policy deployment, and communication with detection servers. Resource exhaustion may appear as slow console pages, delayed incident processing, service instability, or an accumulation of incident files awaiting processing. It is incorrect to state that resources have no impact or that they affect only endpoint agents because Enforce coordinates the broader DLP environment. Symantec DLP also cannot automatically correct every operating-system, storage, or database capacity problem. Administrators must review utilization metrics and compare the deployment workload with supported sizing requirements. Therefore, option B is correct.

================

Questions # 36:

When Symantec DLP is integrated with Microsoft Purview Information Protection (MPIP, also previously known as MIP), to which content types can the Mac DLP Agent apply MPIP labels (classification tags)?

Options:

Microsoft Word, Excel, and PowerPoint files

Microsoft Word, Excel, and PowerPoint files; and Adobe PDF files

Microsoft Word, Excel, and PowerPoint files; and Microsoft Outlook emails

Microsoft Word, Excel, and PowerPoint files; Microsoft Outlook emails; and Adobe PDF files

Answer

Questions # 37:

A DLP administrator created a new agent configuration for an Endpoint server. However, the endpoint agents fail to receive the new configuration.

What is one possible reason that the agent fails to receive the new configuration?

Options:

The new agent configuration was saved but not applied to any endpoint groups.

The new agent configuration was copied and modified from the default agent configuration.

The default agent configuration must be disabled before the new configuration can take effect.

The Endpoint server needs to be recycled so that the new agent configuration can take effect.

Answer

Questions # 38:

Which detection method is best suited for identifying sensitive content within scanned images or image-based PDF files?

Options:

Keyword-Based Detection

Optical Character Recognition (OCR)

Regular Expression Matching

Exact Data Matching (EDM)

Answer

Explanation

Optical Character Recognition is required when sensitive information exists as pixels rather than directly extractable text. A scanned document or image-based PDF may visibly contain names, account numbers, identification numbers, or other protected information, but normal detection rules cannot evaluate those characters until they have been converted into machine-readable text. OCR performs that conversion and passes the extracted text to the DLP detection process, where keywords, regular expressions, Data Identifiers, or other policy rules can inspect it. Keyword and regular-expression matching may operate after OCR processing, but neither technique performs the image-to-text conversion. Exact Data Matching also requires readable and normalized values before comparing content with an index. Therefore, Optical Character Recognition, option B, is the correct detection method.

================

Questions # 39:

What is the first step an administrator should take to improve the performance of Network Monitor when network traffic exceeds 1 Gbps?

Options:

Increase system memory (RAM) for existing Network Prevent servers.

Add more Network Prevent servers to the Symantec DLP environment.

Filter out all network traffic that is unreadable to Network Monitor.

Install network taps and connect them to existing Network Monitor servers.

Answer

Explanation

Network Monitor can inspect only traffic that reaches its capture interfaces and that its protocol and content-analysis components can meaningfully process. When the traffic volume exceeds the supported inspection rate, the first optimization is to eliminate unnecessary traffic before adding infrastructure. Filtering encrypted, unsupported, irrelevant, or otherwise unreadable traffic prevents Network Monitor from consuming capture and processing capacity on sessions that cannot produce useful DLP inspection results. Options A and B incorrectly refer to Network Prevent servers rather than the overloaded Network Monitor detector. Installing additional network taps changes how traffic is copied to Network Monitor but does not inherently reduce the excessive volume being processed. Therefore, filtering unreadable traffic is the appropriate first performance-remediation step, making option C correct.

================

Questions # 40:

Why is it important for an administrator to utilize the grid scan feature?