Month End Sale - Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70xmasdy

Welcome To DumpsPedia

250-587 Sample Questions Answers

Questions 4

What is the Symantec recommended order for stopping Symantec DLP services on a Windows Enforce server?

Options:

A.

Vontu Notifier, Vontu Incident Persister, Vontu Update, Vontu Manager, Vontu Monitor Controller

B.

Vontu Update, Vontu Notifier, Vontu Manager, Vontu Incident Persister, Vontu Monitor Controller

C.

Vontu Incident Persister, Vontu Update, Vontu Notifier, Vontu Monitor Controller, Vontu Manager.

D.

Vontu Monitor Controller, Vontu Incident Persister, Vontu Manager, Vontu Notifier, Vontu Update.

Buy Now
Questions 5

What detection server type requires a minimum of two physical network interface cards?

Options:

A.

Network Prevent for Web

B.

Network Prevent for Email

C.

Network Monitor

D.

Cloud Detection Service (CDS)

Buy Now
Questions 6

A DLP administrator created a new agent configuration for an Endpoint server. However, the endpoint agents fail to receive the new configuration.

What is one possible reason that the agent fails to receive the new configuration?

Options:

A.

The default agent configuration must be disabled before the new configuration can be assigned.

B.

The Endpoint server needs to be recycled so that the new agent configuration can take effect.

C.

The new agent configuration was saved but not applied to any endpoint groups.

D.

The new agent configuration was copied and modified from the default agent configuration.

Buy Now
Questions 7

Why is it important for an administrator to utilize the grid scan feature?

Options:

A.

To distribute the scan workload across multiple network discover servers

B.

To distribute the scan workload across the cloud servers

C.

To distribute the scan workload across multiple endpoint servers

D.

To distribute the scan workload across multiple detection servers

Buy Now
Questions 8

In the context of Network Discover scanning of Exchange servers, what is the Exchange Autodiscover service?

Options:

A.

It is a service on the Discover server that you enable to retrieve files from the Exchange server for detection analysis against your DLP policies.

B.

It is a service on the Exchange server that you enable to fetch Exchange server and mailbox information from Active Directory.

C.

It is a service on the Enforce server that you enable to resolve custom attributes in Network Discover incidents for Exchange servers.

D.

It is a service on the Exchange server that you enable to send files from the Exchange server for detection analysis against your DLP policies.

Buy Now
Questions 9

A DLP administrator is attempting to add a new Network Discover detection server from the Enforce management console. However, the only available options are Network Monitor and Endpoint servers.

What should the administrator do to make the Network Discover option available?

Options:

A.

Restart the Symantec DLP Controller service

B.

Apply a new software license file from the Enforce console

C.

Install a new Network Discover detection server

D.

Restart the Vontu Monitor Service

Buy Now
Questions 10

Which two (2) actions are available for a “Network Prevent: Remove HTTP/HTTPS content” response rule when the content is unable to be removed? (Choose two.)

Options:

A.

Redirect the content to an alternative destination

B.

Block the content from being posted

C.

Encrypt the content before posting

D.

Remove the content through FlexResponse

E.

Allow the content to be posted

Buy Now
Questions 11

A DLP administrator needs to stop the PacketCapture process on a detection server. Upon inspection of the Server Detail page, the administrator discovers that all processes are missing from the display.

What are the processes missing from the Server Detail page display?

Options:

A.

The detection server Display Control Process option is disabled on the Server Detail page.

B.

The Display Process Control setting on the Advanced Settings page is disabled.

C.

The detection server PacketCapture process is displayed on the Server Overview page.

D.

The Advanced Process Control setting on the System Settings page is deselected.

Buy Now
Questions 12

What is the first step an administrator should take to improve the performance of Network Monitor when network traffic exceeds 1 Gbps?

Options:

A.

Increase system memory (RAM) for existing Network Prevent servers.

B.

Add more Network Prevent servers to the Symantec DLP environment.

C.

Filter out all network traffic that is unreadable to Network Monitor.

D.

Install network taps and connect them to existing Network Monitor servers.

Buy Now
Questions 13

Which action should a DLP administrator take to secure communications between an on-premises Enforce server and detection servers hosted in the Cloud?

Options:

A.

Use the built-in Symantec DLP certificate for the Enforce Server, and use the “sslkeytool” utility to create certificates for the detection servers.

B.

Use the built-in Symantec DLP certificate for both the Enforce server and the hosted detection servers.

C.

Set up a Virtual Private Network (VPN) for the Enforce server and the hosted detection servers.

D.

Use the “sslkeytool” utility to create certificates for the Enforce server and the hosted detection servers.

Buy Now
Questions 14

Which type of response rule does Cloud Service for Email use to block confidential emails?

Options:

A.

Network Prevent: Block HTTP/HTTPS

B.

Network Prevent: Block SMTP Message

C.

Cloud Applications and API Appliance: Block Data-in-Motion

D.

Cloud Applications and API Appliance: Redact Data-in-Motion

Buy Now
Questions 15

When Symantec DLP and Symantec CloudSOC are integrated, what must you configure in Enforce to tell CloudSOC which traffic or content to send to the Cloud Detection Service for analysis?

Options:

A.

DLP policies with CloudSOC-specific detection rules and response rules

B.

Cloud Detection Service traffic settings on the Servers and Detectors Overview page

C.

Traffic settings in the Agent Configuration for endpoint computers running the WSS Agent

D.

One or more Application Detection Configurations that include Gatelet and Securlet settings

Buy Now
Questions 16

Which option correctly describes the two-tier installation type for Symantec DLP?

Options:

A.

Install the Oracle database on the host, and install the Enforce server and a detection server on a second host.

B.

Install the Oracle database on a local physical host, and install the Enforce server and detection servers on virtual hosts in the Cloud.

C.

Install the Oracle database and a detection server in the same host, and install the Enforce server on a second host.

D.

Install the Oracle database and Enforce server on the same host, and install detection servers on separate hosts.

Buy Now
Questions 17

Which two detection technology options ONLY run on a detection server? (Choose two.)

Options:

A.

Form Recognition

B.

Indexed Document matching (IDM)

C.

Described Content Matching (DCM)

D.

Exact data matching (EDM)

E.

vector Machine Learning (VML)

Buy Now
Questions 18

What should an incident responder select in the Enforce management console to remediate multiple incidents simultaneously?

Options:

A.

Smart response on the Incident page

B.

Automated Response on the Incident Snapshot page

C.

Smart response on an Incident List report

D.

Automated response on an Incident List report

Buy Now
Questions 19

A company needs to implement Data Owner Exception so that incidents when employees send or receive their own personal information.

What detection method should the company use?

Options:

A.

Indexed Document Matching (IDM)

B.

Vector Machine Learning (VML)

C.

Exact data matching (EDM)

D.

Described Content matching (DCM)

Buy Now
Questions 20

A company needs to secure the content of all mergers and Acquisitions Agreements/ However, the standard text included in all company literature needs to be excluded.

How should the company ensure that this standard text is excluded from detection?

Options:

A.

Create a Whitelisted.txt file after creating the Vector Machine Learning (VML) profile.

B.

Create a Whitelisted.txt file after creating the Exact Data Matching (EDM) profile

C.

Create a Whitelisted.txt file before creating the Indexed Document Matching (IDM) profile

D.

Create a Whitelisted.txt file before creating the Exact Data Matching (EDM) profile

Buy Now
Questions 21

Why would an administrator set the Similarity Threshold to s=zero when testing and tuning a Vector Machine Learning (VML) profile?

Options:

A.

To capture the matches to the Positive set

B.

To capture the matches to the negative set

C.

To see the false negatives only

D.

To see the entire range of potential matches

Buy Now
Questions 22

What is the recommended ratio of Enforce servers to Oracle database servers when deploying Symantec DLP?

Options:

A.

1:1

B.

1:2

C.

2:1

D.

3:1

Buy Now
Questions 23

Which two Infrastructure-as-a-Service providers are supported for hosting Cloud Prevent for Office 365? (Choose two.)

Options:

A.

Any customer-hosted private cloud

B.

Amazon Web Services

C.

AT & T

D.

Verizon

E.

Rackspace

Buy Now
Questions 24

A DLP administrator created a new agent configuration for an Endpoint server. However, the endpoint agents fail to receive the new configuration.

What is one possible reason that the agent fails to receive the new configuration?

Options:

A.

The new agent configuration was saved but not applied to any endpoint groups.

B.

The new agent configuration was copied and modified from the default agent configuration.

C.

The default agent configuration must be disabled before the new configuration can take effect.

D.

The Endpoint server needs to be recycled so that the new agent configuration can take effect.

Buy Now
Questions 25

Which detection server is available from Symantec as a hardware appliance?

Options:

A.

Network Prevent for Email

B.

Network Discover

C.

Network Monitor

D.

Network Prevent for Web

Buy Now
Questions 26

Which Network Prevent action has taken place when a Network incident snapshot indicates the message has been “Modified”?

Options:

A.

Modify content from the body of an email

B.

Add one or more SMTP headers to an email

C.

Obfuscate text in the body of an email

D.

Remove attachments from an email

Buy Now
Questions 27

Which product is able to replace a confidential document residing on a file share with a marker file explaining why the document was removed?

Options:

A.

Network Discover

B.

Cloud Service for Email

C.

Endpoint Prevent

D.

Network Protect

Buy Now
Questions 28

A DLP administrator is preparing to install Symantec DLP and has been asked to use an Oracle database provided by the Database Administration team.

Which SQL *Plus command should the administrator utilize to determine if the database is using a supported version of Oracle?

Options:

A.

select database version from < database name > ;

B.

select * from db$version;

C.

select * from v$version;

D.

select db$ver from < database name > ;

Buy Now
Questions 29

Which of the following actions can you implement ONLY as a Smart Response rule (and not as an automates response rule)?

Options:

A.

All: Limit Incident Data Retention

B.

Network Protect: SharePoint Release From Quarantine

C.

All: Set Attribute

D.

All: Add Note

Buy Now
Questions 30

A DLP administrator needs to remove an agent and its associated events from an Endpoint server.

Which Agent Task should the administrator perform to disable the agent’s visibility in the Enforce management console?

Options:

A.

Delete action from the Agent List page

B.

Disable action from Symantec Management Console

C.

Change Endpoint Server action from the Agent Overview page

D.

Delete action from the Agent Health dashboard

Buy Now
Questions 31

A divisional executive requests a report of all incidents generated by a particular region, summarized by department.

What does the DLP administrator need to configure to generate this report?

Options:

A.

Custom attributes

B.

Status attributes

C.

Sender attributes

D.

User attributes

Buy Now
Questions 32

How should a DLP administrator change a policy that it retains the original file when an endpoint incident has detected a “copy to USB device” operation?

Options:

A.

Add a “Limit Incident Data Retention” response rule with “Retain Original Message” option selected

B.

Modify the agent configuration and select the option “Retain Original Files”

C.

Modify the agent config.db to include the file

D.

Modify the “Endpoint_Retain_Files.int” setting in the Endpoint server configuration

Buy Now
Exam Code: 250-587
Exam Name: Symantec Data Loss Prevention 16.x Administration Technical Specialist
Last Update: Aug 30, 2026
Questions: 108

PDF + Testing Engine

$51.42 $171.4

Testing Engine

$38.57 $128.55

PDF (Q&A)

$42.85 $142.82