250-438 Online Practice Questions and Answers

DRAG DROP

The Symantec Data Loss risk reduction approach has six stages.

Drag and drop the six correct risk reduction stages in the proper order of Occurrence column.

Select and Place:

Which product is able to replace a confidential document residing on a file share with a marker file explaining why the document was removed?

A. Network Discover

B. Cloud Service for Email

C. Endpoint Prevent

D. Network Protect

A DLP administrator has added several approved endpoint devices as exceptions to an Endpoint Prevent policy that blocks the transfer of sensitive data. However, data transfers to these devices are still being blocked. What is the first action an administrator should take to enable data transfers to the approved endpoint devices?

A. Disable and re-enable the Endpoint Prevent policy to activate the changes

B. Double-check that the correct device ID or class has been entered for each device

C. Verify Application File Access Control (AFAC) is configured to monitor the specific application

D. Edit the exception rule to ensure that the "Match On" option is set to "Attachments"

A DLP administrator needs to stop the PacketCapture process on a detection server. Upon inspection of the Server Detail page, the administrator discovers that all processes are missing from the display. What are the processes missing from the Server Detail page display?

A. The Display Process Control setting on the Advanced Settings page is disabled.

B. The Advanced Process Control setting on the System Settings page is deselected.

C. The detection server Display Control Process option is disabled on the Server Detail page.

D. The detection server PacketCapture process is displayed on the Server Overview page.

Which server target uses the "Automated Incident Remediation Tracking" feature in Symantec DLP?

A. Exchange

B. File System

C. Lotus Notes

D. SharePoint

An administrator is unable to log in to the Enforce management console as "sysadmin". Symantec DLP is configured to use Active Directory authentication. The administrator is a member of two roles: "sysadmin" and "remediator." How should the administrator log in to the Enforce console with the "sysadmin" role?

A. sysadmin\username

B. sysadmin\username@domain

C. domain\username

D. username\sysadmin

Refer to the exhibit. Which type of Endpoint response rule is shown?

A. Endpoint Prevent: User Notification

B. Endpoint Prevent: Block

C. Endpoint Prevent: Notify

D. Endpoint Prevent: User Cancel

Which Network Prevent action takes place when the Network Incident list shows the message is "Modified"?

A. Remove attachments from an email

B. Obfuscate text in the body of an email

C. Add one or more SMTP headers to an email

D. Modify content from the body of an email

What detection technology supports partial row matching?

A. Vector Machine Learning (VML)

B. Indexed Document Matching (IDM)

C. Described Content Matching (DCM)

D. Exact Data Matching (EDM)

How do Cloud Detection Service and the Enforce server communicate with each other?

A. Enforce initiates communication with Cloud Detection Service, which is expecting connections on port 8100.

B. Cloud Detection Service initiates communication with Enforce, which is expecting connections on port 443.

C. Cloud Detection Service initiates communication with Enforce, which is expecting connections on port 1443.

D. Enforce initiates communication with Cloud Detection Service, which is expecting connections on port 443.