250-587問題集、Symantec実際の試験問題

質問 1

A DLP administrator needs to remove an agent its associated events from an Endpoint server.
Which Agent Task should the administrator perform to disable the agent's visibility in the Enforce management console?

A. Delete action from the Agent health dashboard

B. Delete action from the Agent List page

C. Disable action from Symantec Management Console

D. Change endpoint Server action from the Agent Overview page

正解: C

質問 2

Which two factors are common sources of data leakage where the main actor is well-meaning insider?
(Choose two.)

A. Merger and Acquisition activities

B. Broken business processes

C. An absence of a trained incident response team

D. Lack of training and awareness

E. A disgruntled employee for a job with a competitor

正解: D,E

質問 3

What is one difference between Exact Data Matching (EDM) and Exact Match Data Identifiers (EMDI)?

A. EDM is better at detecting non-standard delimiters (in ID numbers) than EMDI.

B. EDM rules can be evaluated by the DLP Agent and EMDI rules cannot.

C. EDM is its own detection rule type and EMDI is a Data Identifier validation check.

D. EDM requires an index and EMDI does not.

正解: C

質問 4

Which of the following is a good use case for Structured Data Identifiers (SDIs)?

A. Detecting single instances of Personally Identifiable Information (PII) in Endpoint Discover scans

B. Detecting the copying of healthcare data in tabular format to USB devices from endpoint computers

C. Detecting confidential financial data contained in XLSX or CSV email attachments

D. Detecting partial sections of merger and acquisition documents in Network Discover scans

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 5

Which two technologies should an organization utilize for integration with the Network Prevent products?
(choose two.)

A. Network Firewall

B. Network Tap

C. Mail Transfer Agent

D. Proxy Server

E. Encryption Appliance

正解: C,D

解説: (PassTest メンバーにのみ表示されます)

質問 6

Which option correctly describes the two-tier installation type for Symantec DLP?

A. Install the Oracle database on a local physical host, and install the Enforce server and detection servers on virtual hosts in the Cloud.

B. Install the Oracle database on the host, and install the Enforce server and a detection server on a second host.

C. Install the Oracle database and Enforce server on the same host, and install detection servers on separate hosts.

D. Install the Oracle database and a detection server in the same host, and install the Enforce server on a second host.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 7

A DLP administrator has enabled and successfully tested custom attribute lookups for incident data based on the Active Directory LDAP plugin. The Chief Information Security Officer (CISO) has attempted to generate a User Risk Summary report, but the report is empty. The DLP administrator confirms the Cisco's role has the
"User Reporting" privilege enabled, but User Risk reporting is still not working.
What is the probable reason that the User Risk Summary report is blank?

A. User attributes have been incorrectly mapped to Active Directory accounts.

B. Only DLP administrators are permitted to access and view data for high risk users.

C. The Enforce server has insufficient permissions for importing user attributes.

D. User attribute data must be configured separately from incident data attributed.

正解: A

質問 8

Refer to the exhibit.

What activity should occur during the baseline phase, according to the risk reduction model?

A. Test policies to ensure that blocking actions minimize business process disruptions

B. Monitor incidents and tune the policy to reduce false positives

C. Establish business metrics and begin sending reports to business unit stakeholders

D. Define and build the incident response team

正解: C

Symantec Data Loss Prevention 16.x Administration Technical Specialist - 250-587 模擬練習