Question 1

What are two reasons an administrator should utilize a manual configuration to determine the endpoint location? (Choose two.)

Accepted Answer

The answer of What are two reasons an administrator should...

Question 2

Refer to the exhibit.  What activity should occur during the baseline phase, according to the risk reduction model?

Accepted Answer

The answer of Refer to the exhibit.  What activity...

Question 3

A DLP administrator determines that the \ SymantecDLP\Protect\Incidents folder on the Enforce server contains. BAD files dated today, while other. IDC files are flowing in and out of the \Incidents directory. Only .IDC files larger than 1MB are turning to .BAD files. What could be causing only incident data smaller than 1MB to persist while incidents larger than 1MB change to .BAD files?

Accepted Answer

The .BAD files indicate that there is an issue with processing the incident data. If the tablespace is almost full, larger files cannot be processed and are turned into .BAD files, while smaller files that require less space can still be processed.

Question 4

What detection technology supports partial contents matching?

Accepted Answer

Indexed Document Matching (IDM) supports partial contents matching by indexing documents and allowing for the identification of specific parts or segments within those documents.

Question 5

Which two detection technology options ONLY run on a detection server? (Choose two.)

Accepted Answer

Indexed Document Matching (IDM) and Exact Data Matching (EDM) are detection technologies that require a detection server to process and analyze data against pre-indexed or exact data sets.

Question 6

A DLP administrator needs to remove an agent its associated events from an Endpoint server. Which Agent Task should the administrator perform to disable the agent's visibility in the Enforce management console?

Accepted Answer

The answer of A DLP administrator needs to remove an...

Question 7

A DLP administrator has enabled and successfully tested custom attribute lookups for incident data based on the Active Directory LDAP plugin. The Chief Information Security Officer (CISO) has attempted to generate a User Risk Summary report, but the report is empty. The DLP administrator confirms the Cisco's role has the "User Reporting" privilege enabled, but User Risk reporting is still not working. What is the probable reason that the User Risk Summary report is blank?

Accepted Answer

The answer of A DLP administrator has enabled and successfully...

Question 8

What is required on the Enforce server to communicate with the Symantec DLP database?

Accepted Answer

The answer of What is required on the Enforce server...

Question 9

How should a DLP administrator change a policy so that it retains the original file when an endpoint incident has detected a "cope to USB device" operation?

Accepted Answer

The "Limit Incident Data Retention" response rule allows the administrator to specify how long incident data is retained. By selecting the "retain Original Message" option, the original file will be retained when an endpoint incident has detected a "cope to USB device" operation.

Question 10

Where should an administrator set the debug levels for an Endpoint Agent?

Accepted Answer

The answer of Where should an administrator set the debug...

Question 11

Which two DLP products support the new Optical Character Recognition (OCR) engine in Symantec DLP 15.0? (Choose two.)

Accepted Answer

The answer of Which two DLP products support the new...

Question 12

What detection technology supports partial row matching?

Accepted Answer

The answer of What detection technology supports partial row matching?
...

Question 13

A company needs to implement Data Owner Exception so that incidents are avoided when employees send or receive their own personal information. What detection method should the company use?

Accepted Answer

Exact Data Matching (EDM) is used to detect specific data values, such as personal information, by matching them against a database of known values, making it suitable for implementing Data Owner Exception.

Question 14

Which server target uses the "Automated Incident Remediation Tracking" feature in Symantec DLP?

Accepted Answer

The "Automated Incident Remediation Tracking" feature in Symantec DLP is used for the File System server target.

Question 15

What is the correct order for data in motion when a customer has integrated their CloudSOC and DLP solutions?

Accepted Answer

The answer of What is the correct order for data...

Question 16

Which two factors are common sources of data leakage where the main actor is well-meaning insider? (Choose two.)

Accepted Answer

The answer of Which two factors are common sources of...

Question 17

A software company wants to protect its source code, including new source code created between scheduled indexing runs. Which detection method should the company use to meet this requirement?

Accepted Answer

Indexed Document Matching (IDM) is used to protect source code by indexing documents and detecting matches, including new code created between indexing runs.

Question 18

Which tool must a DLP administrator run to certify the database prior to upgrading DLP?

Accepted Answer

The Upgrade Readiness Tool is specifically designed to certify the database and ensure that it meets all necessary requirements before proceeding with a DLP upgrade.

Question 19

Which two technologies should an organization utilize for integration with the Network Prevent products? (choose two.)

Accepted Answer

The answer of Which two technologies should an organization utilize...

Question 20

Which Network Prevent action takes place when the Network Incident list shows the message is "Modified"?

Accepted Answer

The answer of Which Network Prevent action takes place when...

Exam 4: Administration of Symantec ProxySG 6.7