Summer Certification Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: clap70

250-587 Symantec Data Loss Prevention 16.x Administration Technical Specialist Questions and Answers

Questions 4

A compliance officer needs to understand how the company is complying with its data security policies over time.

Which report should be compliance officer generate to obtain the compliance information?

Options:

A.

Policy report, filtered on date and summarized by policy

B.

Policy Trend report, summarized by policy, then quarter

C.

Policy report, filtered on quarter and summarized by policy

D.

Policy Trend report, summarized by policy, then severity

Buy Now
Questions 5

An organization wants to restrict employees to copy files only a specific set of USB thumb drives owned by the organization.

Which detection method should the organization use to meet this requirement?

Options:

A.

Exact data Matching (EDM)

B.

Indexed Document matching (IDM)

C.

Described Content Matching (DCM)

D.

Vector Machine Learning (VML)

Buy Now
Questions 6

A DLP administrator needs to remove an agent and its associated events from an Endpoint server.

Which Agent Task should the administrator perform to disable the agent’s visibility in the Enforce management console?

Options:

A.

Delete action from the Agent List page

B.

Disable action from Symantec Management Console

C.

Change Endpoint Server action from the Agent Overview page

D.

Delete action from the Agent Health dashboard

Buy Now
Questions 7

A software company wants to protect its source code, including new source code created between scheduled indexing runs.

Which detection method should the company use to meet this requirement?

Options:

A.

Exact Data Matching (EDM)

B.

Described Content Matching (DCM)

C.

Vector Machine Learning (VML)

D.

Indexed Document Matching (IDM)

Buy Now
Questions 8

What should an incident responder select in the Enforce management console to remediate multiple incidents simultaneously?

Options:

A.

Smart Response on the Incident Snapshot page

B.

Automated Response on an Incident List report

C.

Smart Response on an Incident List report

D.

Automated Response on the Incident Snapshot page

Buy Now
Questions 9

Which two (2) technologies should an organization utilize for integration with the Network Prevent products? (Choose two.)

Options:

A.

Mail Transfer Agent

B.

Network Tap

C.

Proxy Server

D.

Network Firewall

E.

Encryption Appliance

Buy Now
Questions 10

Which two technologies should an organization utilize for integration with the Network Prevent products? (choose two.)

Options:

A.

Network Tap

B.

Network Firewall

C.

Proxy Server

D.

Mail Transfer Agent

E.

Encryption Appliance

Buy Now
Questions 11

Where in the Enforce management console can a DLP administrator change the “UI.NO_SCAN.int” setting to disable the “Inspecting data” pop-up?

Options:

A.

Advanced Server Settings from the Endpoint Server Configuration

B.

Advanced Monitoring from the Agent Configuration

C.

Advanced Agent Settings from the Agent Configuration

D.

Application Monitoring from the Agent Configuration

Buy Now
Questions 12

When managing an Endpoint Discover scan, a DLP administrator notices some endpoint computers are NOT completing their scans.

When does the DLP agent stop scanning?

Options:

A.

When the agent sends a report within the “Scan Idle Timeout” period

B.

When the endpoint computer is rebooted and the agent is started

C.

When the agent is unable to send a status report within the “Scan Idle Timeout” period

D.

When the agent sends a report immediately after the “Scan Idle Timeout” period

Buy Now
Questions 13

A customer needs to integrate information from DLP incidents into external Governance, Risk and Compliance dashboards.

Which feature should a third party component integrate with to provide dynamic reporting, create custom incident remediation processes, or support business processes?

Options:

A.

Export incidents using the CSV format

B.

Incident Reporting and Update API

C.

Incident Data Views

D.

A Web incident extraction report

Buy Now
Questions 14

An administrator is unable to log in to the Enforce management console as “sysadmin”. Symantec DLP is configured to use Active Directory authentication. The administrator is a member of two roles: “sysadmin” and “remediator.”

How should the administrator log in to the Enforce console with the “sysadmin” role?

Options:

A.

sysadmin\username

B.

sysadmin\username@domain

C.

domain\username

D.

username\sysadmin

Buy Now
Questions 15

Which statement accurately describes where Optical Character Recognition (OCR) components must be installed?

Options:

A.

The OCR engine must be installed on detection server other than the Enforce server.

B.

The OCR server software must be installed on one or more dedicated (non-detection) Linux servers.

C.

The OCR engine must be directly on the Enforce server.

D.

The OCR server software must be installed on one or more dedicated (non-detection) Windows servers.

Buy Now
Questions 16

What is the correct order for data in motion when a customer has integrated their CloudSOC and DLP solutions?

Options:

A.

User > CloudSOC Gatelet > DLP Cloud Detection Service > Application

B.

User > Enforce > Application

C.

User > Enforce > CloudSOC > Application

D.

User > CloudSOC Gatelet > Enforce > Application

Buy Now
Questions 17

Which two locations can Symantec DLP scan and perform Information Centric Encryption (ICE) actions on? (Choose two.)

Options:

A.

Exchange

B.

Jiveon

C.

File store

D.

SharePoint

E.

Confluence

Buy Now
Questions 18

What are two reasons an administrator should utilize a manual configuration to determine the endpoint location? (Choose two.)

Options:

A.

To specify Wi-Fi SSID names

B.

To specify an IP address or range

C.

To specify the endpoint server

D.

To specify domain names

E.

To specify network card status (ON/OFF)

Buy Now
Questions 19

What are two (2) reasons an administrator should utilize a manual configuration to determine the endpoint location? (Choose two.)

Options:

A.

To specify the endpoint server

B.

To specify an IP address or range

C.

To specify network card status (ON/OFF)

D.

To specify domain names

E.

To specify Wi-Fi SSID names

Buy Now
Questions 20

What detection method utilizes Data Identifiers?

Options:

A.

Indexed Document matching (IDM)

B.

Described Content Matching (DCM)

C.

Directory Group Matching (DGM)

D.

Exact Data Matching (EDM)

Buy Now
Questions 21

A customer needs to integrate information form DLP incidents into external Governance, Risk, and Compliance dashboards.

Which feature should a third-party component integrate with to provide dynamic reporting, create custom incident remediation processes, or support business processes?

Options:

A.

Incident Reporting and Update API

B.

Export incidents using the CSV format

C.

A web incident extraction report

D.

Incident Data Views

Buy Now
Questions 22

Which two automated response rules will be active in policies that include Exact Data Matching (EDM) detection rule? (Choose two.)

Options:

A.

Endpoint Discover: Quarantine File

B.

All: Send Email Notification

C.

Endpoint Prevent: User Cancel

D.

Endpoint Prevent: Block

E.

Network Protect: Quarantine File

Buy Now
Questions 23

The Symantec Data Loss risk reduction approach has six stages.

Drag and drop the six correct risk reduction stages in the proper order of Occurrence column.

Options:

Buy Now
Questions 24

Which action is available for use in both Smart Response and Automated Response rules?

Options:

A.

Log to a Syslog Server

B.

Limit incident data retention

C.

Modify SMTP message

D.

Block email message

Buy Now
Questions 25

What is the correct installation sequence for the components shown here, according to the Symantec Installation Guide?

Place the options in the correct installation sequence.

Options:

Buy Now
Questions 26

Which detection server is available from Symantec as a hardware appliance?

Options:

A.

Network Prevent for Email

B.

Network Discover

C.

Network Monitor

D.

Network Prevent for Web

Buy Now
Questions 27

Which two Network Discover/Cloud Storage targets apply Information Centric Encryption as policy response rules?

Options:

A.

Microsoft Exchange

B.

Windows File System

C.

SQL Databases

D.

Microsoft SharePoint

E.

Network File System (NFS)

Buy Now
Questions 28

Which type of response rule does Cloud Service for Email use to block confidential emails?

Options:

A.

Network Prevent: Block HTTP/HTTPS

B.

Network Prevent: Block SMTP Message

C.

Cloud Applications and API Appliance: Block Data-in-Motion

D.

Cloud Applications and API Appliance: Redact Data-in-Motion

Buy Now
Questions 29

What is the Symantec recommended order for stopping Symantec DLP services on a Windows Enforce server?

Options:

A.

Vontu Notifier, Vontu Incident Persister, Vontu Update, Vontu Manager, Vontu Monitor Controller

B.

Vontu Update, Vontu Notifier, Vontu Manager, Vontu Incident Persister, Vontu Monitor Controller

C.

Vontu Incident Persister, Vontu Update, Vontu Notifier, Vontu Monitor Controller, Vontu Manager.

D.

Vontu Monitor Controller, Vontu Incident Persister, Vontu Manager, Vontu Notifier, Vontu Update.

Buy Now
Questions 30

A DLP administrator is testing Network Prevent for Web functionality. When the administrator posts a small test file to a cloud storage website, no new incidents are reported.

What should the administrator do to allow incidents to be generated against this file?

Options:

A.

Change the “Ignore requests Smaller Than” value to 1

B.

Add the filename to the Inspect Content Type field

C.

Change the “PacketCapture.DISCARD_HTTP_GET” value to “false”

D.

Uncheck trial mode under the ICAP tab

Buy Now
Exam Code: 250-587
Exam Name: Symantec Data Loss Prevention 16.x Administration Technical Specialist
Last Update: Jun 19, 2026
Questions: 0
250-587 pdf

250-587 PDF

$25.5  $84.99
250-587 Engine

250-587 Testing Engine

$30  $99.99
250-587 PDF + Engine

250-587 PDF + Testing Engine

$255  $850