Symantec Data Loss Prevention Exam 250-438 Dumps Questions

1. How should a DLP administrator change a policy so that it retains the original file when an endpoint incident has detected a “cope to USB device” operation?

2. What is the correct configuration for “BoxMonitor.Channels”that will allow the server to start as a Network Monitor server?

3. Under the “System Overview” in the Enforce management console, the status of a Network Monitor detection server is shown as “Running Selected.” The Network Monitor server’s event logs indicate that the packet capture and filereader processes are crashing.

What is a possible cause for the Network Monitor server being in this state?

4. Which two Infrastructure-as-a-Service providers are supported for hosting Cloud Prevent for Office 365? (Choose two.)

5. A DLP administrator has enabled and successfully tested custom attribute lookups for incident data based on the Active Directory LDAP plugin. The Chief Information Security Officer (CISO) has attempted to generate a User Risk Summary report, but the report is empty. The DLP administrator confirms the Cisco’s role has the “User Reporting” privilege enabled, but User Risk reporting is still not working.

What is the probable reason that the User Risk Summary report is blank?

6. How should a DLP administrator exclude a custom endpoint application named “custom_app.exe” from being monitoring by Application File Access Control?

7. A software company wants to protect its source code, including new source code created between scheduled indexing runs.

Which detection method should the company use to meet this requirement?

8. What are two reasons an administrator should utilize a manual configuration to determine the endpoint location? (Choose two.)

9. What detection server is used for Network Discover, Network Protect, and Cloud Storage?

10. Which product is able to replace a confidential document residing on a file share with a marker file explaining why the document was removed?

11. Which two locations can Symantec DLP scan and perform Information Centric Encryption (ICE) actions on? (Choose two.)

12. Which detection method depends on “training sets”?

13. Which action should a DLP administrator take to secure communications between an on-premises Enforce server and detection servers hosted in the Cloud?

14. Which option correctly describes the two-tier installation type for Symantec DLP?

15. Which two detection technology options run on the DLP agent? (Choose two.)

16. A DLP administrator has added several approved endpoint devices as exceptions to an Endpoint Prevent policy that blocks the transfer of sensitive data.

However, data transfers to these devices are still being blocked.

What is the first action an administrator should take to enable data transfers to the approved endpoint devices?

17. What is the default fallback option for the Endpoint Prevent Encrypt response rule?

18. Which two components can perform a file system scan of a workstation? (Choose two.)

19. Which channel does Endpoint Prevent protect using Device Control?

20. A divisional executive requests a report of all incidents generated by a particular region, summarized by department.

What does the DLP administrator need to configure to generate this report?

21. A DLP administrator needs to stop the PacketCapture process on a detection server. Upon inspection of the Server Detail page, the administrator discovers that all processes are missing from the display.

What are the processes missing from the Server Detail page display?

22. What detection technology supports partial contents matching?

23. What is Application Detection Configuration?

24. What detection method utilizes Data Identifiers?

25. When managing an Endpoint Discover scan, a DLP administrator notices some endpoint computers are NOT completing their scans.

When does the DLP agent stop scanning?

26. Which two detection servers are available as virtual appliances? (Choose two.)

27. A company needs to secure the content of all mergers and Acquisitions Agreements/ However, the standard text included in all company literature needs to be excluded.

How should the company ensure that this standard text is excluded from detection?

28. Which server target uses the “Automated Incident Remediation Tracking” feature in Symantec DLP?