250-587

250-587 practice questions, page 2 of 3, with answer review and explanations.

Question 6

Which detection server is available from Symantec as a hardware appliance?

  1. Network Prevent for Email
  2. Network Prevent for Web
  3. Network Monitor
  4. Network Discover

Question 7

How should a DLP administrator exclude a custom endpoint application named “custom_app.exe” from being monitored by Application File Access Control?

  1. Add “custom_app.exe” to the “Program Exclusion List” in the agent configuration settings.
  2. Add “custom_app.exe” to the “Application Whitelist” on all Endpoint servers.
  3. Add a “custom_app.exe” Application Monitoring Configuration and de-select all its channel options.
  4. Add “custom_app.exe” as a filename exception to the Endpoint Prevent policy.

Question 8

Refer to the exhibit. What activity should occur during the baseline phase, according to the risk reduction model?

  1. Monitor incidents and tune the policy to reduce false positives
  2. Define and build the incident response team
  3. Establish business metrics and begin sending reports to business unit stakeholders
  4. Test policies to ensure that blocking actions minimize business process disruptions

Question 9

How should a DLP administrator change a policy that it retains the original file when an endpoint incident has detected a “copy to USB device” operation?

  1. Add a “Limit Incident Data Retention” response rule with “Retain Original Message” option selected
  2. Modify the agent configuration and select the option “Retain Original Files”
  3. Modify the agent config.db to include the file
  4. Modify the “Endpoint_Retain_Files.int” setting in the Endpoint server configuration

Question 10

Which two (2) of the following automated response rule types could be successfully executed by a policy who’s only detection rule is an Exact Data Matching (EDM) rule? (Choose two.)

  1. Endpoint Prevent: Block
  2. All: Send Email Notification
  3. Endpoint Discover: Quarantine File
  4. Network Protect: Quarantine File
  5. Endpoint Prevent: User Cancel