Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: cramtick70

250-587 Symantec Data Loss Prevention 16.x Administration Technical Specialist Questions and Answers

Questions 4

A DLP administrator is preparing to install Symantec DLP and has been asked to use an Oracle database provided by the Database Administration team.

Which SQL *Plus command should the administrator utilize to determine if the database is using a supported version of Oracle?

Options:

A.

select database version from < database name > ;

B.

select * from db$version;

C.

select * from v$version;

D.

select db$ver from < database name > ;

Buy Now
Questions 5

Which two (2) actions are available for a “Network Prevent: Remove HTTP/HTTPS content” response rule when the content is unable to be removed? (Choose two.)

Options:

A.

Redirect the content to an alternative destination

B.

Block the content from being posted

C.

Encrypt the content before posting

D.

Remove the content through FlexResponse

E.

Allow the content to be posted

Buy Now
Questions 6

What should an administrator do if DLP policies are generating too many false positives?

Options:

A.

Ignore incident reports until a critical issue arises.

B.

Disable all policies temporarily.

C.

Allow users to approve exceptions manually.

D.

Refine detection methods, such as Exact Data Matching (EDM) and fingerprinting.

Buy Now
Questions 7

A DLP administrator has performed a test deployment of the DLP 15.0 Endpoint agent and now wants to uninstall the agent. However, the administrator no longer remembers the uninstall password.

What should the administrator do to work around the password problem?

Options:

A.

Apply a new global agent uninstall password in the Enforce management console.

B.

Manually delete all the Endpoint agent files from the test computer and install a new agent package.

C.

Replace the PGPsdk.dll file on the agent’s assigned Endpoint server with a copy from a different Endpoint server

D.

Use the UninstallPwdGenerator to create an UninstallPasswordKey.

Buy Now
Questions 8

A customer needs to integrate information form DLP incidents into external Governance, Risk, and Compliance dashboards.

Which feature should a third-party component integrate with to provide dynamic reporting, create custom incident remediation processes, or support business processes?

Options:

A.

Incident Reporting and Update API

B.

Export incidents using the CSV format

C.

A web incident extraction report

D.

Incident Data Views

Buy Now
Questions 9

What detection method utilizes Data Identifiers?

Options:

A.

Indexed Document matching (IDM)

B.

Described Content Matching (DCM)

C.

Directory Group Matching (DGM)

D.

Exact Data Matching (EDM)

Buy Now
Questions 10

A DLP administrator is attempting to add a new Network Discover detection server from the Enforce management console. However, the only available options are Network Monitor and Endpoint servers.

What should the administrator do to make the Network Discover option available?

Options:

A.

Restart the Symantec DLP Controller service

B.

Apply a new software license file from the Enforce console

C.

Install a new Network Discover detection server

D.

Restart the Vontu Monitor Service

Buy Now
Questions 11

Which two technologies should an organization utilize for integration with the Network Prevent products? (choose two.)

Options:

A.

Network Tap

B.

Network Firewall

C.

Proxy Server

D.

Mail Transfer Agent

E.

Encryption Appliance

Buy Now
Questions 12

Why would an administrator set the Similarity Threshold to zero when testing and tuning a Vector Machine Learning (VML) profile?

Options:

A.

To capture the matches to the Negative set

B.

To capture the matches to the Positive set

C.

To see the entire range of potential matches

D.

To see the false negatives only

Buy Now
Questions 13

Which two automated response rules will be active in policies that include Exact Data Matching (EDM) detection rule? (Choose two.)

Options:

A.

Endpoint Discover: Quarantine File

B.

All: Send Email Notification

C.

Endpoint Prevent: User Cancel

D.

Endpoint Prevent: Block

E.

Network Protect: Quarantine File

Buy Now
Questions 14

What is Application Detection Configuration?

Options:

A.

The Cloud Detection Service (CDS) process that tells Enforce a policy has been violated

B.

The Data Loss Prevention (DLP) policy which has been pushed into Cloud Detection Service (CDC) for files in transit to or residing in Cloud apps

C.

The terminology describing the Data Loss Prevention (DLP) process within the CloudSOC administration portal

D.

the setting configured within the user interface (UI) that determines whether CloudSOC should send a file to Cloud Detection Service (CDS) for analysis.

Buy Now
Questions 15

Which two components can perform a file system scan of a workstation? (Choose two.)

Options:

A.

Endpoint Server

B.

DLP Agent

C.

Network Prevent for Web Server

D.

Discover Server

E.

Enforce Server

Buy Now
Questions 16

How should a DLP administrator change a policy that it retains the original file when an endpoint incident has detected a “copy to USB device” operation?

Options:

A.

Add a “Limit Incident Data Retention” response rule with “Retain Original Message” option selected

B.

Modify the agent configuration and select the option “Retain Original Files”

C.

Modify the agent config.db to include the file

D.

Modify the “Endpoint_Retain_Files.int” setting in the Endpoint server configuration

Buy Now
Questions 17

A DLP administrator created a new agent configuration for an Endpoint server. However, the endpoint agents fail to receive the new configuration.

What is one possible reason that the agent fails to receive the new configuration?

Options:

A.

The new agent configuration was saved but not applied to any endpoint groups.

B.

The new agent configuration was copied and modified from the default agent configuration.

C.

The default agent configuration must be disabled before the new configuration can take effect.

D.

The Endpoint server needs to be recycled so that the new agent configuration can take effect.

Buy Now
Questions 18

When configuring Network Prevent for Email, what is the role of Mail Transfer Agents (MTAs)?

Options:

A.

To secure web browsers

B.

To monitor general network traffic

C.

To capture and inspect email traffic

D.

To manage network firewalls

Buy Now
Questions 19

Which two locations can Symantec DLP scan and perform Information Centric Encryption (ICE) actions on? (Choose two.)

Options:

A.

Exchange

B.

Jiveon

C.

File store

D.

SharePoint

E.

Confluence

Buy Now
Questions 20

What is the first step an administrator should take to improve the performance of Network Monitor when network traffic exceeds 1 Gbps?

Options:

A.

Increase system memory (RAM) for existing Network Prevent servers.

B.

Add more Network Prevent servers to the Symantec DLP environment.

C.

Filter out all network traffic that is unreadable to Network Monitor.

D.

Install network taps and connect them to existing Network Monitor servers.

Buy Now
Questions 21

A compliance officer needs to understand how the company is complying with its data security policies over time.

Which report should be compliance officer generate to obtain the compliance information?

Options:

A.

Policy report, filtered on date and summarized by policy

B.

Policy Trend report, summarized by policy, then quarter

C.

Policy report, filtered on quarter and summarized by policy

D.

Policy Trend report, summarized by policy, then severity

Buy Now
Questions 22

How should a DLP administrator exclude a custom endpoint application named “custom_app.exe” from being monitored by Application File Access Control?

Options:

A.

Add “custom_app.exe” to the “Program Exclusion List” in the agent configuration settings.

B.

Add “custom_app.exe” to the “Application Whitelist” on all Endpoint servers.

C.

Add a “custom_app.exe” Application Monitoring Configuration and de-select all its channel options.

D.

Add “custom_app.exe” as a filename exception to the Endpoint Prevent policy.

Buy Now
Questions 23

Which network Prevent action takes place when the network Incident list shows the message is “Modified”?

Options:

A.

Remove attachments from an email

B.

Obfuscate text in the body of an email

C.

Add one or more SMTP headers to an email

D.

Modify content from the body of an email

Buy Now
Questions 24

A DLP administrator needs to remove an agent and its associated events from an Endpoint server.

Which Agent Task should the administrator perform to disable the agent’s visibility in the Enforce management console?

Options:

A.

Delete action from the Agent List page

B.

Disable action from Symantec Management Console

C.

Change Endpoint Server action from the Agent Overview page

D.

Delete action from the Agent Health dashboard

Buy Now
Questions 25

A DLP administrator needs to remove an agent its associated events from an Endpoint server.

Which Agent Task should the administrator perform to disable the agent’s visibility in the Enforce management console?

Options:

A.

Delete action from the Agent health dashboard

B.

Delete action from the Agent List page

C.

Disable action from Symantec Management Console

D.

Change endpoint Server action from the Agent Overview page

Buy Now
Questions 26

When Symantec DLP and Symantec CloudSOC are integrated, what must you configure in Enforce to tell CloudSOC which traffic or content to send to the Cloud Detection Service for analysis?

Options:

A.

DLP policies with CloudSOC-specific detection rules and response rules

B.

Cloud Detection Service traffic settings on the Servers and Detectors Overview page

C.

Traffic settings in the Agent Configuration for endpoint computers running the WSS Agent

D.

One or more Application Detection Configurations that include Gatelet and Securlet settings

Buy Now
Questions 27

A DLP administrator has added several approved endpoint devices as exceptions to an Endpoint Prevent policy that blocks the transfer of sensitive data. However, data transfers to these devices are still being blocked.

What is the first action an administrator should take to enable data transfers to the approved endpoint devices?

Options:

A.

Disable and re-enable the Endpoint Prevent policy to activate the changes

B.

Double-check that the correct device ID or class has been entered for each device

C.

Verify Application File Access Control (AFAC) is configured to monitor the specific application

D.

Edit the exception rule to ensure that the “Match On” option is set to “Attachments”

Buy Now
Questions 28

What is the recommended ratio of Enforce servers to Oracle database servers when deploying Symantec DLP?

Options:

A.

1:1

B.

1:2

C.

2:1

D.

3:1

Buy Now
Questions 29

When Symantec DLP is integrated with Microsoft Purview Information Protection (MPIP, also previously known as MIP), to which content types can the Mac DLP Agent apply MPIP labels (classification tags)?

Options:

A.

Microsoft Word, Excel, and PowerPoint files

B.

Microsoft Word, Excel, and PowerPoint files; and Adobe PDF files

C.

Microsoft Word, Excel, and PowerPoint files; and Microsoft Outlook emails

D.

Microsoft Word, Excel, and PowerPoint files; Microsoft Outlook emails; and Adobe PDF files

Buy Now
Questions 30

How should a DLP administrator exclude a custom endpoint application named “custom_app.exe” from being monitoring by Application File Access Control?

Options:

A.

Add “custom_app.exe” to the “Application Whitelist” on all Endpoint servers.

B.

Add “custom_app.exe” Application Monitoring Configuration and de-select all its channel options.

C.

Add “custom_app_.exe” as a filename exception to the Endpoint Prevent policy.

D.

Add “custom_app.exe” to the “Program Exclusion List” in the agent configuration settings.

Buy Now
Questions 31

A DLP administrator needs to stop the PacketCapture process on a detection server. Upon inspection of the Server Detail page, the administrator discovers that all processes are missing from the display.

What are the processes missing from the Server Detail page display?

Options:

A.

The detection server Display Control Process option is disabled on the Server Detail page.

B.

The Display Process Control setting on the Advanced Settings page is disabled.

C.

The detection server PacketCapture process is displayed on the Server Overview page.

D.

The Advanced Process Control setting on the System Settings page is deselected.

Buy Now
Questions 32

A customer needs to integrate information from DLP incidents into external Governance, Risk and Compliance dashboards.

Which feature should a third party component integrate with to provide dynamic reporting, create custom incident remediation processes, or support business processes?

Options:

A.

Export incidents using the CSV format

B.

Incident Reporting and Update API

C.

Incident Data Views

D.

A Web incident extraction report

Buy Now
Exam Code: 250-587
Exam Name: Symantec Data Loss Prevention 16.x Administration Technical Specialist
Last Update: Aug 20, 2026
Questions: 108
250-587 pdf

250-587 PDF

$25.5  $84.99
250-587 Engine

250-587 Testing Engine

$30  $99.99
250-587 PDF + Engine

250-587 PDF + Testing Engine

$40.5  $134.99