Symantec Data Loss Prevention (DLP) Practice Test

These questions are part of the practice quiz. Start practicing

• Which detection technology supports partial row matching?
• Which elements are commonly stored in a central DLP database?
• Which product is able to replace a confidential document residing on a file share with a marker file explaining why the document was removed?
• To exclude standard boilerplate text from IDM detection, which file should be created before creating the IDM profile?
• How should a DLP administrator exclude a custom endpoint application named custom_app.exe from being monitored by Application File Access Control?
• How does Symantec DLP integrate with email servers to enforce data protection?
• Which detection method helps avoid incidents involving employees' own personal information?
• What is the role of cloud DLP connectors in enforcement?
• Only IDC files larger than 1MB become BAD files; what is the most likely root cause?
• Which detection server type requires a minimum of two physical network interface cards?
• Setting the Similarity Threshold to zero reveals which aspect during testing?
• In the recommended Windows Enforce stop order, which service is stopped second?
• How would you describe DLP enforcement at web gateways?
• What is a primary reason to prepare a rollback plan when staging a DLP deployment to production?
• How does data classification integrate with DLP policies and why is it important?
• Which detection server is available from Symantec as a hardware appliance?
• In policies that include Exact Data Matching, which action is performed by Endpoint Discover?
• Which of the following is a remediation action available in Symantec DLP?
• Which statement best contrasts data discovery with DLP?
• Which statement about deployment components sharing policy packs and incident data is true?
• Which virtual appliance is available for Web detection?
• Which utility is used to create certificates for the detection servers?
• Why would an administrator set the Similarity Threshold to zero when testing and tuning a Vector Learning Machine profile?
• Which statement about detection methods is true?
• What mechanism enables applying different DLP rules per unit with overrides?
• Which of the following is NOT typically found in DLP dashboards for executives and security teams?
• Where can the detection servers be hosted in a deployment?
• Which service is responsible for persisting detected incidents on the Enforce server?
• What is the proper order of the six stages in the Symantec Data Loss risk reduction approach?
• Which sequence best represents a typical DLP incident lifecycle?
• Why is tuning threshold and rule scope important in DLP, and what strategies help?
• How does privacy-by-design relate to DLP policy development?
• Which folder on the Enforce server stores incident files?
• What detection method utilizes Data Identifiers?
• What detection technology supports partial contents matching?
• A company needs to implement Data Owner Exception so that incidents are avoided when employees send or receive their own personal information. What detection method should the company use?
• Which report should a compliance officer generate to understand how the company is complying with data security policies over time?
• Compare continuous monitoring vs point-in-time scanning in DLP.
• What must be configured to generate a report of incidents by region and department?
• Where in the Enforce management console is the status of a Network Monitor detection server displayed as Running Selected?
• How can DLP interact with content repositories like SharePoint or OneDrive?
• What is the role of data classification in DLP policies?
• What is required on the Enforce server to communicate with the Symantec DLP database?
• Which of the following lists best describes how Unicode content should be handled in DLP detections?
• Which aspects are included in a DLP policy for testing/validation and incident handling?
• Where in the Enforce management console can a DLP administrator change the 'UI.NO_SCAN.int' setting to disable the 'Inspecting data' pop-up?
• Which two technologies should an organization utilize for integration with the Network Prevent products? (Choose two)
• Which SQL*Plus command should you use to determine if the Oracle database is using a supported version for installation?
• A Network Monitor detection server shows as Running Selected, but its event logs show that the packet capture and file reader processes are crashing. What is a possible cause?
• What does data in motion refer to in DLP, and how does Symantec DLP protect it?
• What is the primary role of an Auditor in a DLP program?
• What is the role of ticketing systems in DLP incident management, and which integrations are common?
• Which action should you perform to make the endpoint agent's events invisible in Enforce?
• What are best practices for data retention and disposal policies within DLP?
• Which statement correctly distinguishes data masking from redaction in DLP remediation actions?
• Which statement is true about the relationship between IDC and BAD files in the incident folder?
• In the installation sequence Oracle Database/Enforce Server/Solution Pack/Detection Server, which component is installed last?
• A DLP administrator is attempting to add a new Network Discover detection server from the Enforce management console, but only Network Monitor and Endpoint servers are shown. What should the administrator do to enable Network Discover?
• In the data in motion flow, which component appears after CloudSOC?
• What is the Symantec recommended order for stopping Symantec DLP services on a Windows Enforce server?
• Which virtual appliance is available for Email detection?
• Which components can perform a file system scan of a workstation?
• Endpoint Discover scanning stops when the DLP agent cannot send a status report within what period?
• The CISO has attempted to generate a User Risk Summary report, but it is blank despite User Reporting privileges. What is the probable reason?
• What are recommended steps when staging a DLP deployment to production?
• In the Enforce server, which file extension represents normal incident data?
• Which statement about ICE is correct?
• Which service encrypts the message when using a Modify SMTP Message response rule?
• What action typically triggers remediation in a DLP workflow?
• Which port is used for Cloud Detection Service communications with the Enforce server?
• Which items are typically included in DLP audit trails and evidence for compliance?
• What types of data-in-use controls does Endpoint DLP provide to prevent data leakage through devices?
• In the data in motion flow, which component comes immediately after User when CloudSOC is integrated?
• What is the effect of cross-channel alerts in a DLP system?
• Which component is deployed on endpoints to enable data scanning under DLP?
• In a Network Prevent content response rule, which action is appropriate when the content cannot be removed?
• How do you approach false positives and false negatives in DLP tuning?
• What factors should be considered when protecting data in cloud apps with DLP?
• During the baseline phase in the risk reduction model, what should you establish and begin doing?
• Which notification option is documented as a method for alerting after a policy match?
• Which regex pattern can detect a U.S.-style email address?
• Which statement best describes the difference between a content fingerprint and a regular expression for data detection?
• What does EDM stand for in Symantec DLP?
• Why is it important for an administrator to utilize the grid scan feature?
• What is centralized in the Management Server to enable unified remediation and reporting across DLP components?
• How do you manage and update detection orders and priority when multiple rules trigger simultaneously?
• Which statement about ticketing system integrations in DLP incident management is most accurate?
• Which capability should a third-party system integrate with to receive DLP incident data and drive custom workflows?
• Which endpoint response rule would block an action on the endpoint?
• What is the correct BoxMonitor.Channels configuration that will allow the server to start as a Network Monitor server?
• Where should an administrator set the debug levels for an Endpoint Agent?
• How should a DLP administrator change a policy so that it retains the original file when an endpoint incident has detected a copy to USB device operation?
• How can DLP policy scope be aligned with business units and organizational units?
• How do Cloud Detection Service and the Enforce server communicate with each other?
• When protecting data in cloud apps with DLP, why is user behavior a factor?
• What is the purpose of content fingerprinting in DLP, in practical terms?
• Which are the primary deployment options for Symantec DLP?
• To restrict copying files only to a specific set of organization-owned USB drives, which detection method should be used?
• What is data at rest and how does DLP enforce protection?
• Describe the typical incident workflow from detection to closure in Symantec DLP.
• How should GDPR data subjects' rights requests be reflected in DLP workflows?
• What is the correct action to take to enable Network Discover in the Enforce deployment when only certain server types are visible?
• What are lexicons in DLP used for?
• What is the correct installation sequence for Oracle Database, Enforce Server, Solution Pack, and Detection Server?
• Which component can perform a file system scan of a workstation besides the DLP Agent?
• Which tool must be run to certify the database prior to upgrading DLP?
• What are common maintenance activities for a Symantec DLP rollout to ensure ongoing effectiveness?
• In a two-tier deployment, where should the Oracle database and Enforce server be installed?
• Where must OCR components be installed?
• What is the name of the rule that retains the original message during incident data retention?
• What should an incident responder select in the Enforce management console to remediate multiple incidents simultaneously?
• Before deploying a DLP policy, which practice helps ensure changes are safe?
• Which two detection technology options ONLY run on a detection server? (Choose two)
• Which option is an accurate use case for Information Centric Encryption (ICE)?
• Which file size threshold triggers conversion of IDC files to BAD?
• Which two DLP products support the new OCR engine in Symantec DLP 15.0?
• What is a common remediation action for protecting data exposure in DLP?
• What is the purpose of distributing the grid scan workload across multiple detection servers?
• What is the concept of legal hold in relation to DLP incidents?
• Explain content fingerprinting in DLP and when you would use it.
• If approved endpoint exceptions do not prevent data transfers as expected, what is the first action to take?
• Which tools support testing a DLP policy?
• Why are phased rollouts recommended in DLP deployments?
• In privacy-by-design, what principle focuses on restricting access to the minimum necessary to perform duties?
• What is the default fallback option for the Endpoint Prevent Encrypt response rule?
• What condition caused all processes to be missing from the Server Detail page display in a DLP environment?
• What is Application Detection Configuration?
• What is the purpose of testing a DLP policy?
• In the Enforce management console, detection servers show 'unknown'. Which service on the Enforce server should be started to bring them to a running state?
• How should you manage and update lexicons to maintain accuracy?
• In a DLP governance model, which role is primarily responsible for defining data loss prevention rules?
• Where is the Advanced Process Control setting located in the DLP console?
• Which statement best describes how fingerprints and regex differ in DLP detection?
• During the baseline phase, what is the expected outcome related to metrics and reporting?
• What is a data identifier in DLP and how is it used to classify content?
• Which of the following is a common source of data leakage when the main actor is a well-meaning insider?
• To secure communications between an on-prem Enforce server and cloud detection servers, which action should you take?
• Which of the following is a reason to manually configure the endpoint location to specify an IP address or range?
• A customer needs to integrate information from DLP incidents into external Governance, Risk and Compliance dashboards. Which feature should a third party component integrate with to provide dynamic reporting, create custom incident remediation processes, or support business processes?
• To exclude a specific executable from Application File Access Control monitoring, which action is required?
• Which data types are commonly mapped to PII, PHI, and PCI categories in DLP, and why mapping is important?
• What does ICE stand for in Symantec DLP?
• A DLP administrator needs to remove an agents associated events from an Endpoint server. Which Agent Task should the administrator perform to disable the agent's visibility in the Enforce management console?
• Name three PCI DSS data patterns that DLP can detect and a suitable detection approach.
• Which server target uses the Automated Incident Remediation Tracking feature?
• Which of the following is a reason to manually configure the endpoint location by domain names?
• Which detection server is used for Network Discover, Network Protect, and Cloud Storage?
• What is a policy pack in DLP and how is it used?
• Which statement best describes the use of policy packs in deployment to groups or environments?
• Which detection method depends on training sets?
• What is data tokenization and when would you use it in DLP?
• In the DLP incident lifecycle, what is the primary purpose of the evidence collection step?
• Which statement about DLP policy exceptions is true?
• In which scenarios would you choose Block vs Monitor as an enforcement action per channel?
• Which action is available for use in both Smart Response and Automated Response rules?
• How do you enforce DLP for cloud apps like Office 365 or Google Workspace?
• An Endpoint agent fails to receive a new configuration. What is one possible reason for this failure?
• What are the main components of a DLP policy and their roles?
• How does DLP integrate with web proxies or gateways for web channel protection?
• When testing Network Prevent for Web functionality, no incidents are reported for a small file posted to a cloud storage website. What should you modify to allow incidents to be generated?
• What is the correct order for data in motion when a customer has integrated their CloudSOC and DLP solutions?
• What configuration change is most likely required to produce data in User Risk Summary reports?
• A software company wants to protect its source code, including new source code created between scheduled indexing runs. Which detection method should the company use to meet this requirement?
• In policies that include Exact Data Matching, which action is performed by Endpoint Prevent?
• Which of the following is typically included in DLP dashboards for executives and security teams?
• How should an administrator log in to Enforce with the sysadmin role when using Active Directory authentication?
• Which channel does Endpoint Prevent protect using Device Control?
• How is DLP data stored in its database and what performance considerations exist?
• What capability does IDM provide in DLP?
• What does IDM stand for in Symantec DLP?
• Which mechanism enables a unified view across network, endpoint, and cloud DLP by sharing components?
• Which of the following is a valid location where Symantec DLP can scan and apply Information Centric Encryption actions?
• How does DLP handle data at rest within file servers and endpoints?
• Which two automated response rules will be active in policies that include Exact Data Matching detection rule?
• Which of the following pairs of providers are supported for hosting Cloud Prevent for Office 365? (Choose Two)
• If the uninstall password for the DLP 15.0 Endpoint agent is forgotten, what is the recommended workaround?
• A DLP policy can enforce across which channels?
• Which Network Prevent action takes place when the Network Incident list shows the message is 'Modified'?
• Which two Network Discover/Cloud Storage targets apply Information Centric Encryption as policy response rules? (Choose two)
• Which option correctly describes the two-tier installation type for Symantec DLP?