PassTest 250-583リアル試験問題250-583練習問題集
厳密検証された250-583試験問題集と解答で無料提供の250-583問題と正解付き
質問 # 58
What condition triggers Policy Shadowing warnings in the Admin Console?
- A. DLP fingerprints overlap
- B. A new rule duplicates but is lower priority than an existing rule
- C. An application is unmapped to any Site
- D. Connector logs exceed 1 GB/day
正解：B
解説：
Overlapping rules can render lower ones ineffective.
質問 # 59
Which Admin-Portal role can read logs and view DLP incidents but cannot edit Policies?
- A. Policy Admin
- B. Site Manager
- C. Security Analyst
- D. Tenant Admin
正解：C
解説：
Security Analyst is a read-only operational role.
質問 # 60
A multi-tenant MSSP manages several customer ZTNA tenants.
Which practices streamline operations while preserving tenant isolation?
- A. Consolidate all tenants under one Admin Console instance
- B. Share a global DNS zone across tenants to reduce complexity
- C. Delegate per-tenant RBAC roles for policy operations
- D. Use a single SIEM pipeline with tenant-tagged log events
正解：C、D
解説：
Tenant-tagged logs and scoped RBAC maintain isolation; shared DNS or single Console risks data crossover.
質問 # 61
A delegated admin must be able to create Policies but not modify Authentication settings.
Which RBAC design satisfies the requirement?
- A. Grant "Site Manager" privileges plus SIEM read access
- B. Assign "Policy Admin" role at Tenant level
- C. Assign "Policy Admin" role to a specific Collection
- D. Clone the "Tenant Admin" role and disable Authentication edit rights
正解：C
解説：
Collection-scoped Policy Admin confines privileges to policy tasks without exposing global authentication.
質問 # 62
Which two Time-Based Access scenarios are natively supported?
- A. Shift-based user access windows
- B. Per-session NAT port rotation
- C. Sun-set-sun-rise geofence rules
- D. Calendar-triggered Policy exemptions
正解：A、D
解説：
Policies can use time schedules; NAT port rotation is unrelated.
質問 # 63
What advantage does Health-Check Web-hooks offer over traditional email alerts?
- A. Encrypts notifications with Connector secrets
- B. Allows alerts to bypass SIEM parsing
- C. Avoids TLS overhead in outbound notifications
- D. Enables programmatic remediation workflows in SOAR tools
正解：D
解説：
Web-hooks feed incident data directly into automation pipelines.
質問 # 64
If DNS tunneling detection is enabled, what is a likely enforcement reaction?
- A. Connector terminates the session and raises high-severity alert
- B. Session is throttled to 8 kbps
- C. Policy shadowing event logged as warning
- D. IDP token is revoked
正解：A
解説：
Malicious tunneling triggers termination.
質問 # 65
Why is TLS 1.3 preferred for Connector-Cloud communications?
- A. Provides forward secrecy and faster handshakes
- B. Allows static RSA key reuse
- C. Supports GRE encapsulation natively
- D. Enables clear-text JA3 fingerprinting
正解：A
解説：
TLS 1.3 improves security and performance.
質問 # 66
A Zero-Trust rollout mandates step-wise onboarding to avoid productivity loss.
Which Portal feature supports this?
- A. Log replay simulator for historical policies
- B. Plan -> Onboard wizard that stages Sites, Apps, Policies sequentially
- C. Global kill-switch that blocks traffic instantly
- D. Bulk CSV importer for all Policy objects
正解：B
解説：
The wizard guides phased deployment.
質問 # 67
How does Symantec ZTNA assist auditors in validating compliance for regulated workloads?
- A. Generates automated SOC 1 reports
- B. Allows direct database queries to the logging backend
- C. Disables policy edits during audit windows
- D. Exports searchable, signed log files with tamper-evident hashes
正解：D
解説：
Signed logs with hashes give auditors integrity assurance.
質問 # 68
Why is the Admin Audit Trail considered immutable?
- A. Audit records stream directly to DLP for retention
- B. Only Tenant Admins can see the trail, blocking edits
- C. Logs are stored in volatile memory but mirrored to three zones
- D. Entries are cryptographically hashed and appended-only
正解：D
解説：
Append-only hashing prevents alteration.
質問 # 69
A security analyst notices high latency for traffic inspected by Cloud SWG.
Which two tunings can reduce latency without compromising security?
- A. Increase Site-to-Connector MTU above 1500 bytes
- B. Disable TLS inspection on all traffic
- C. Use regional Connectors to shorten route path
- D. Enable selective bypass for low-risk SaaS domains
正解：C、D
解説：
Regional Connectors and selective bypass improve performance; oversized MTU and blanket TLS disablement are ineffective or risky.
質問 # 70
In a hybrid IDP model, why might you implement OIDC alongside SAML?
- A. SAML does not allow MFA
- B. OIDC supports XML signatures
- C. Mobile apps often prefer OIDC tokens over SAML assertions
- D. Connector firmware only parses OIDC
正解：C
解説：
Modern native clients leverage OIDC.
質問 # 71
When might you choose to leverage on-prem SIEM instead of cloud SIEM for ZTNA logs?
- A. Faster deployment time
- B. Built-in visualization dashboards
- C. Desire to reduce CapEx
- D. Strict data-residency laws preventing log egress
正解：D
解説：
Residency constraints keep logs local; cost and dashboards are secondary.
質問 # 72
Which two conditions must be true for Zero Trust evaluation when a user accesses an internal web application agent-lessly?
- A. User's IDP token includes a group claim mapped in the Policy
- B. Application is defined in Admin Console and bound to a Policy
- C. Connector resides on the same VLAN as the application server
- D. DNS resolution is delegated to the Cloud SWG service
正解：A、B
解説：
Explicit application mapping and group-based policy binding are required; VLAN location and SWG DNS are optional.
質問 # 73
A policy uses user risk score, device posture, and application sensitivity.
What decision model does this illustrate?
- A. Time-based access schedule
- B. IP-sec tunnel classification
- C. Static ACL enforcement
- D. Adaptive, context-aware Zero Trust evaluation
正解：D
解説：
Combining identity, device, and app context is the core of adaptive Zero Trust.
質問 # 74
During log-shipping configuration, which parameter ensures message order and integrity when forwarding to a cloud-hosted SIEM?
- A. Base64 encoding of entire log stream
- B. TLS mutual authentication between Connector and SIEM
- C. UDP transport with jumbo frames
- D. Time-sliced gzip batching
正解：B
解説：
TLS with mutual auth guarantees channel integrity and ordered delivery; UDP lacks guarantees.
質問 # 75
Which two integrations enhance visibility for unmanaged IoT devices that cannot run the Symantec Agent?
- A. SPAN/TAP port feeding traffic to a discovery Connector
- B. TIS dynamic reputation look-ups for device IPs
- C. DHCP server logging into the SIEM for MAC correlation
- D. Agent-based posture checks with relaxed policies
正解：A、B
解説：
Network taps and TIS reputation add context for agentless IoT.
質問 # 76
Finally, what is the primary objective of Symantec ZTNA within the broader SASE framework?
- A. Serve as on-prem firewall management console
- B. Provide global MPLS replacement
- C. Replace email security gateways
- D. Grant application-level access based on continuous, context-aware evaluation
正解：D
解説：
ZTNA delivers granular, adaptive access-the core of Zero-Trust within SASE.
質問 # 77
......
無料でゲット！高評価Broadcom 250-583試験問題集を今すぐダウンロード！：https://www.passtest.jp/Broadcom/250-583-shiken.html
あなたを合格させる250-583無料最新問題集でBroadcom練習テスト：https://drive.google.com/open?id=1OdW-uZEP8y26N9GgJChn5iSjOyGRfuWQ