Symantec 250-438 Online Practice Questions and Exam Preparation

Symantec 250-438 Online Questions & Answers

• Question 21:

  What detection technology supports partial contents matching?

  A. Indexed Document Matching (IDM)
  B. Described Content Matching (DCM)
  C. Exact Data Matching (EDM)
  D. Optical Character Recognition (OCR)
  A. Indexed Document Matching (IDM)

  ---

  Reference: https://help.symantec.com/cs/dlp15.1/DLP/v115965297_v125428396/Mac-agent-detection-technologies?locale=EN_US

• Question 22:

  What are two reasons an administrator should utilize a manual configuration to determine the endpoint location? (Choose two.)

  A. To specify Wi-Fi SSID names
  B. To specify an IP address or range
  C. To specify the endpoint server
  D. To specify domain names
  E. To specify network card status (ON/OFF)
  B. To specify an IP address or range
  D. To specify domain names

  ---

  Reference: https://help.symantec.com/cs/dlp15.1/DLP/v18349332_v125428396/Setting-the-endpoint-location?locale=EN_US

• Question 23:

  An organization wants to restrict employees to copy files only a specific set of USB thumb drives owned by the organization. Which detection method should the organization use to meet this requirement?

  A. Exact Data Matching (EDM)
  B. Indexed Document Matching (IDM)
  C. Described Content Matching (DCM)
  D. Vector Machine Learning (VML)
  D. Vector Machine Learning (VML)

• Question 24:

  Under the "System Overview" in the Enforce management console, the status of a Network Monitor detection server is shown as "Running Selected." The Network Monitor server's event logs indicate that the packet capture and filereader processes are crashing.

  What is a possible cause for the Network Monitor server being in this state?

  A. There is insufficient disk space on the Network Monitor server.
  B. The Network Monitor server's certificate is corrupt or missing.
  C. The Network Monitor server's license file has expired.
  D. The Enforce and Network Monitor servers are running different versions of DLP.
  D. The Enforce and Network Monitor servers are running different versions of DLP.

• Question 25:

  Which two components can perform a file system scan of a workstation? (Choose two.)

  A. Endpoint Server
  B. DLP Agent
  C. Network Prevent for Web Server
  D. Discover Server
  E. Enforce Server
  B. DLP Agent
  D. Discover Server

• Question 26:

  DRAG DROP

  The Symantec Data Loss risk reduction approach has six stages.

  Drag and drop the six correct risk reduction stages in the proper order of Occurrence column.

  Select and Place:

  

  

  ---

  Reference: https://www.slideshare.net/iftikhariqbal/symantec-data-loss-prevention-technical-proposal-general

• Question 27:

  Which statement accurately describes where Optical Character Recognition (OCR) components must be installed?

  A. The OCR engine must be installed on detection server other than the Enforce server.
  B. The OCR server software must be installed on one or more dedicated (non-detection) Linux servers.
  C. The OCR engine must be directly on the Enforce server.
  D. The OCR server software must be installed on one or more dedicated (non-detection) Windows servers.
  C. The OCR engine must be directly on the Enforce server.

  ---

  Reference: https://help.symantec.com/cs/dlp15.0/DLP/v122760174_v120691346/Setting-up-OCR-Servers?locale=EN_US

• Question 28:

  A DLP administrator is attempting to add a new Network Discover detection server from the Enforce management console. However, the only available options are Network Monitor and Endpoint servers. What should the administrator do to make the Network Discover option available?

  A. Restart the Symantec DLP Controller service
  B. Apply a new software license file from the Enforce console
  C. Install a new Network Discover detection server
  D. Restart the Vontu Monitor Service
  C. Install a new Network Discover detection server

• Question 29:

  A customer needs to integrate information from DLP incidents into external Governance, Risk and Compliance dashboards.

  Which feature should a third party component integrate with to provide dynamic reporting, create custom incident remediation processes, or support business processes?

  A. Export incidents using the CSV format
  B. Incident Reporting and Update API
  C. Incident Data Views
  D. A Web incident extraction report
  B. Incident Reporting and Update API

• Question 30:

  What is required on the Enforce server to communicate with the Symantec DLP database?

  A. Port 8082 should be opened
  B. CryptoMasterKey.properties file
  C. Symbolic links to .dbf files
  D. SQL*Plus Client
  D. SQL*Plus Client

  ---

  Reference: https://www.symantec.com/connect/articles/three-tier-installation-dlp-product