250-438: Administration of Symantec Data Loss Prevention 15

How should a DLP administrator change a policy so that it retains the original file when an endpoint incident has detected a “cope to USB device” operation?

Add a “Limit Incident Data Retention” response rule with “retain Original Message” option selected.
Modify the agent config.db to include the file
Modify the “Endpoint_Retain_Files.int” setting in the Endpoint server configuration
Modify the agent configuration and select the option “retain Original Files”

Correct answer: A

Under the “System Overview” in the Enforce management console, the status of a Network Monitor detection server is shown as “Running Selected.” The Network Monitor server’s event logs indicate that the packet capture and filereader processes are crashing.

What is a possible cause for the Network Monitor server being in this state?

There is insufficient disk space on the Network Monitor server.
The Network Monitor server’s certificate is corrupt or missing.
The Network Monitor server’s license file has expired.
The Enforce and Network Monitor servers are running different versions of DLP.

Correct answer: D

A DLP administrator has enabled and successfully tested custom attribute lookups for incident data based on the Active Directory LDAP plugin. The Chief Information Security Officer (CISO) has attempted to generate a User Risk Summary report, but the report is empty. The DLP administrator confirms the Cisco’s role has the “User Reporting” privilege enabled, but User Risk reporting is still not working.

What is the probable reason that the User Risk Summary report is blank?

Only DLP administrators are permitted to access and view data for high risk users.
The Enforce server has insufficient permissions for importing user attributes.
User attribute data must be configured separately from incident data attributed.
User attributes have been incorrectly mapped to Active Directory accounts.

Correct answer: D

How should a DLP administrator exclude a custom endpoint application named “custom_app.exe” from being monitoring by Application File Access Control?

Add “custom_app.exe” to the “Application Whitelist” on all Endpoint servers.
Add “custom_app.exe” Application Monitoring Configuration and de-select all its channel options.
Add “custom_app_.exe” as a filename exception to the Endpoint Prevent policy.
Add “custom_app.exe” to the “Program Exclusion List” in the agent configuration settings.

Correct answer: A

Explanation:

Reference: https://docs.mcafee.com/bundle/data-loss-prevention-11.0.400-product-guide-epolicy-orchestrator/page/GUID-0F81A895-0A46-4FF8-A869-0365D6620185.html

A software company wants to protect its source code, including new source code created between scheduled indexing runs.

Which detection method should the company use to meet this requirement?

Exact Data Matching (EDM)
Described Content Matching (DCM)
Vector Machine Learning (VML)
Indexed Document Matching (IDM)

Correct answer: D

Explanation:

Reference: https://help.symantec.com/cs/DLP15.0/DLP/v100774847_v120691346/Scheduling-remote-indexing?locale=EN_US

What are two reasons an administrator should utilize a manual configuration to determine the endpoint location? (Choose two.)

To specify Wi-Fi SSID names
To specify an IP address or range
To specify the endpoint server
To specify domain names
To specify network card status (ON/OFF)

Correct answer: BD

Explanation:

Reference: https://help.symantec.com/cs/dlp15.1/DLP/v18349332_v125428396/Setting-the-endpoint-location?locale=EN_US

Which two locations can Symantec DLP scan and perform Information Centric Encryption (ICE) actions on? (Choose two.)

Exchange
Jiveon
File store
SharePoint
Confluence

Correct answer: CD

Explanation:

Reference: https://www.symantec.com/content/dam/symantec/docs/data-sheets/information-centric-encryption-en.pdf

Which detection method depends on “training sets”?

Form Recognition
Vector Machine Learning (VML)
Index Document Matching (IDM)
Exact Data Matching (IDM)

Correct answer: B

Explanation:

Reference: http://eval.symantec.com/mktginfo/enterprise/white_papers/b-dlp_machine_learning.WP_en-us.pdf

Which action should a DLP administrator take to secure communications between an on-premises Enforce server and detection servers hosted in the Cloud?

Use the built-in Symantec DLP certificate for the Enforce Server, and use the “sslkeytool” utility to create certificates for the detection servers.
Use the built-in Symantec DLP certificate for both the Enforce server and the hosted detection servers.
Set up a Virtual Private Network (VPN) for the Enforce server and the hosted detection servers.
Use the “sslkeytool” utility to create certificates for the Enforce server and the hosted detection servers.

Correct answer: A

Explanation:

Reference: https://www.symantec.com/connect/articles/sslkeytool-utility-and-server-certificates

Which two detection technology options run on the DLP agent? (Choose two.)

Optical Character Recognition (OCR)
Described Content Matching (DCM)
Directory Group Matching (DGM)
Form Recognition
Indexed Document Matching (IDM)

Correct answer: DE

Vendor:	Symantec
Exam Code:	250-438
Exam Name:	Administration of Symantec Data Loss Prevention 15
Date:	May 01, 2019
File Size:	173 KB

Download Administration of Symantec Data Loss Prevention 15.250-438.Pass4Sure.2019-05-01.40q.vcex

How to open VCEX files?

Demo Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

ProfExam at a 20% markdown