Symantec 250-438 Online Practice Questions and Exam Preparation

Symantec 250-438 Online Questions & Answers

• Question 1:

  A company needs to implement Data Owner Exception so that incidents are avoided when employees send or receive their own personal information. What detection method should the company use?

  A. Indexed Document Matching (IDM)
  B. Vector Machine Learning (VML)
  C. Exact Data Matching (EDM)
  D. Described Content Matching (DCM)
  C. Exact Data Matching (EDM)

  ---

  Reference: https://help.symantec.com/cs/dlp15.5/DLP/v40148006_v128674454/About-Data-Owner-Exception?locale=EN_US

• Question 2:

  Where in the Enforce management console can a DLP administrator change the "UI.NO_SCAN.int" setting to disable the "Inspecting data" pop-up?

  A. Advanced Server Settings from the Endpoint Server Configuration
  B. Advanced Monitoring from the Agent Configuration
  C. Advanced Agent Settings from the Agent Configuration
  D. Application Monitoring from the Agent Configuration
  C. Advanced Agent Settings from the Agent Configuration

  ---

  Reference: https://www.symantec.com/connect/forums/dlp-pop-examining-content

• Question 3:

  Which product is able to replace a confidential document residing on a file share with a marker file explaining why the document was removed?

  A. Network Discover
  B. Cloud Service for Email
  C. Endpoint Prevent
  D. Network Protect
  D. Network Protect

  ---

  Reference: https://help.symantec.com/cs/dlp15.1/DLP/v15600645_v125428396/Configuring-Network-Protect-for-file-shares?locale=EN_US

• Question 4:

  How do Cloud Detection Service and the Enforce server communicate with each other?

  A. Enforce initiates communication with Cloud Detection Service, which is expecting connections on port 8100.
  B. Cloud Detection Service initiates communication with Enforce, which is expecting connections on port 443.
  C. Cloud Detection Service initiates communication with Enforce, which is expecting connections on port 1443.
  D. Enforce initiates communication with Cloud Detection Service, which is expecting connections on port 443.
  D. Enforce initiates communication with Cloud Detection Service, which is expecting connections on port 443.

• Question 5:

  Which two actions are available for a "Network Prevent: Remove HTTP/HTTPS content" response rule when the content is unable to be removed? (Choose two.)

  A. Allow the content to be posted
  B. Remove the content through FlexResponse
  C. Block the content before posting
  D. Encrypt the content before posting
  E. Redirect the content to an alternative destination
  A. Allow the content to be posted
  E. Redirect the content to an alternative destination

• Question 6:

  Why is it important for an administrator to utilize the grid scan feature?

  A. To distribute the scan workload across multiple network discover servers
  B. To distribute the scan workload across the cloud servers
  C. To distribute the scan workload across multiple endpoint servers
  D. To distribute the scan workload across multiple detection servers
  D. To distribute the scan workload across multiple detection servers

  ---

  If you plan to use the grid scanning feature to distribute the scanning workload across multiple detection servers, retain the default value (1)

• Question 7:

  How should a DLP administrator change a policy so that it retains the original file when an endpoint incident has detected a "copy to USB device" operation?

  A. Add a "Limit Incident Data Retention" response rule with "Retain Original Message" option selected.
  B. Modify the agent config.db to include the file
  C. Modify the "Endpoint_Retain_Files.int" setting in the Endpoint server configuration
  D. Modify the agent configuration and select the option "Retain Original Files"
  A. Add a "Limit Incident Data Retention" response rule with "Retain Original Message" option selected.

• Question 8:

  Which two detection technology options ONLY run on a detection server? (Choose two.)

  A. Form Recognition
  B. Indexed Document Matching (IDM)
  C. Described Content Matching (DCM)
  D. Exact Data Matching (EDM)
  E. Vector Machine Learning (VML)
  B. Indexed Document Matching (IDM)
  D. Exact Data Matching (EDM)

  ---

  Reference: https://support.symantec.com/en_US/article.INFO5070.html

• Question 9:

  What detection server type requires a minimum of two physical network interface cards?

  A. Network Prevent for Web
  B. Network Prevent for Email
  C. Network Monitor
  D. Cloud Detection Service (CDS)
  A. Network Prevent for Web

• Question 10:

  Which two automated response rules will be active in policies that include Exact Data Matching (EDM) detection rule? (Choose two.)

  A. Endpoint Discover: Quarantine File
  B. All: Send Email Notification
  C. Endpoint Prevent: User Cancel
  D. Endpoint Prevent: Block
  E. Network Protect: Quarantine File
  A. Endpoint Discover: Quarantine File
  D. Endpoint Prevent: Block