Summer Sale - 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dm70dm

250-587 Symantec Data Loss Prevention 16.x Administration Technical Specialist Questions and Answers

Questions 4

How should a DLP administrator exclude a custom endpoint application named “custom_app.exe” from being monitored by Application File Access Control?

Options:

A.

Add “custom_app.exe” to the “Program Exclusion List” in the agent configuration settings.

B.

Add “custom_app.exe” to the “Application Whitelist” on all Endpoint servers.

C.

Add a “custom_app.exe” Application Monitoring Configuration and de-select all its channel options.

D.

Add “custom_app.exe” as a filename exception to the Endpoint Prevent policy.

Buy Now
Questions 5

A DLP administrator is preparing to install Symantec DLP and has been asked to use an Oracle database provided by the Database Administration team.

Which SQL *Plus command should the administrator utilize to determine if the database is using a supported version of Oracle?

Options:

A.

select database version from < database name > ;

B.

select * from db$version;

C.

select * from v$version;

D.

select db$ver from < database name > ;

Buy Now
Questions 6

Which option correctly describes the two-tier installation type for Symantec DLP?

Options:

A.

Install the Oracle database on the host, and install the Enforce server and a detection server on a second host.

B.

Install the Oracle database on a local physical host, and install the Enforce server and detection servers on virtual hosts in the Cloud.

C.

Install the Oracle database and a detection server in the same host, and install the Enforce server on a second host.

D.

Install the Oracle database and Enforce server on the same host, and install detection servers on separate hosts.

Buy Now
Questions 7

Which two Infrastructure-as-a-Service providers are supported for hosting Cloud Prevent for Office 365? (Choose two.)

Options:

A.

Any customer-hosted private cloud

B.

Amazon Web Services

C.

AT & T

D.

Verizon

E.

Rackspace

Buy Now
Questions 8

Which network DLP products support User Risk-Based Detection, in which Symantec DLP uses Symantec Information Centric Analytics (ICA) user risk scores in policy detection rules?

Options:

A.

Network Prevent for Email only

B.

Network Prevent for Web only

C.

Network Prevent for Email and Network Prevent for Web only

D.

Network Monitor, Network Prevent for Email, and Network Prevent for Web

Buy Now
Questions 9

Which two components can perform a file system scan of a workstation? (Choose two.)

Options:

A.

Endpoint Server

B.

DLP Agent

C.

Network Prevent for Web Server

D.

Discover Server

E.

Enforce Server

Buy Now
Questions 10

Which of the following actions can you implement ONLY as a Smart Response rule (and not as an automates response rule)?

Options:

A.

All: Limit Incident Data Retention

B.

Network Protect: SharePoint Release From Quarantine

C.

All: Set Attribute

D.

All: Add Note

Buy Now
Questions 11

Which action should a DLP administrator take to secure communications between an on-premises Enforce server and detection servers hosted in the Cloud?

Options:

A.

Use the built-in Symantec DLP certificate for the Enforce Server, and use the “sslkeytool” utility to create certificates for the detection servers.

B.

Use the built-in Symantec DLP certificate for both the Enforce server and the hosted detection servers.

C.

Set up a Virtual Private Network (VPN) for the Enforce server and the hosted detection servers.

D.

Use the “sslkeytool” utility to create certificates for the Enforce server and the hosted detection servers.

Buy Now
Questions 12

What detection server type requires a minimum of two physical network interface cards?

Options:

A.

Network Prevent for Web

B.

Network Prevent for Email

C.

Network Monitor

D.

Cloud Detection Service (CDS)

Buy Now
Questions 13

What is required on the Enforce server to communicate with the Symantec DLP database?

Options:

A.

Port 8082 should be opened

B.

CryptoMasterKey.properties file

C.

Symbolic links to .dbf files

D.

SQL*plus Client

Buy Now
Questions 14

Where in the Enforce management console can a DLP administrator change the “UI.NO_SCAN.int” setting to disable the “Inspecting data” pop-up?

Options:

A.

Advanced Server Settings from the Endpoint Server Configuration

B.

Advanced Monitoring from the Agent Configuration

C.

Advanced Agent Settings from the Agent Configuration

D.

Application Monitoring from the Agent Configuration

Buy Now
Questions 15

Which two (2) detection technology options run on the DLP agent? (Choose two.)

Options:

A.

Indexed Document Matching (IDM)

B.

Directory Group Matching (DGM)

C.

Described Content Matching (DCM)

D.

Optical Character Recognition (OCR)

E.

Form Recognition

Buy Now
Questions 16

What detection server is used for Network Discover, Network Protect, and Cloud Storage?

Options:

A.

Network Protect Storage Discover

B.

Network Discover/Cloud Storage Discover

C.

Network Prevent/Cloud Detection Service

D.

Network Protect/Cloud Detection Service

Buy Now
Questions 17

Which two automated response rules will be active in policies that include Exact Data Matching (EDM) detection rule? (Choose two.)

Options:

A.

Endpoint Discover: Quarantine File

B.

All: Send Email Notification

C.

Endpoint Prevent: User Cancel

D.

Endpoint Prevent: Block

E.

Network Protect: Quarantine File

Buy Now
Questions 18

What should an incident responder select in the Enforce management console to remediate multiple incidents simultaneously?

Options:

A.

Smart response on the Incident page

B.

Automated Response on the Incident Snapshot page

C.

Smart response on an Incident List report

D.

Automated response on an Incident List report

Buy Now
Questions 19

What is the Symantec recommended order for stopping Symantec DLP services on a Windows Enforce server?

Options:

A.

Vontu Notifier, Vontu Incident Persister, Vontu Update, Vontu Manager, Vontu Monitor Controller

B.

Vontu Update, Vontu Notifier, Vontu Manager, Vontu Incident Persister, Vontu Monitor Controller

C.

Vontu Incident Persister, Vontu Update, Vontu Notifier, Vontu Monitor Controller, Vontu Manager.

D.

Vontu Monitor Controller, Vontu Incident Persister, Vontu Manager, Vontu Notifier, Vontu Update.

Buy Now
Questions 20

Under the “System Overview” in the Enforce management console, the status of a Network Monitor detection server is shown as “Running Selected.” The Network Monitor server’s event logs indicate that the packet capture and filereader processes are crashing.

What is a possible cause for the Network Monitor server being in this state?

Options:

A.

There is insufficient disk space on the Network Monitor server.

B.

The Network Monitor server’s certificate is corrupt or missing.

C.

The Network Monitor server’s license file has expired.

D.

The Enforce and Network Monitor servers are running different versions of DLP.

Buy Now
Questions 21

Refer to the exhibit. Which type of Endpoint response rule is shown?

250-587 Question 21

Options:

A.

Endpoint Prevent: User Notification

B.

Endpoint Prevent: Block

C.

Endpoint Prevent: Notify

D.

Endpoint Prevent: User Cancel

Buy Now
Questions 22

Which type of detector integrates with Symantec CloudSOC?

Options:

A.

Cloud Detection Service for REST

B.

Cloud Detection Service for ICAP

C.

Cloud Detection Service for SMTP

D.

Cloud Prevent detector

Buy Now
Questions 23

Which two Network Discover/Cloud Storage targets apply Information Centric Encryption as policy response rules?

Options:

A.

Microsoft Exchange

B.

Windows File System

C.

SQL Databases

D.

Microsoft SharePoint

E.

Network File System (NFS)

Buy Now
Questions 24

A DLP administrator determines that the \SymantecDLP\Protect\Incidents folder on the Enforce server contains. BAD files dated today, while other. IDC files are flowing in and out of the \Incidents directory. Only .IDC files larger than 1MB are turning to .BAD files.

What could be causing only incident data smaller than 1MB to persist while incidents larger than 1MB change to .BAD files?

Options:

A.

A corrupted policy was deployed.

B.

The Enforce server’s hard drive is out of space.

C.

A detection server has excessive filereader restarts.

D.

Tablespace is almost full.

Buy Now
Questions 25

In the context of Network Discover scanning of Exchange servers, what is the Exchange Autodiscover service?

Options:

A.

It is a service on the Discover server that you enable to retrieve files from the Exchange server for detection analysis against your DLP policies.

B.

It is a service on the Exchange server that you enable to fetch Exchange server and mailbox information from Active Directory.

C.

It is a service on the Enforce server that you enable to resolve custom attributes in Network Discover incidents for Exchange servers.

D.

It is a service on the Exchange server that you enable to send files from the Exchange server for detection analysis against your DLP policies.

Buy Now
Questions 26

Which detection server is available from Symantec as a hardware appliance?

Options:

A.

Network Prevent for Email

B.

Network Discover

C.

Network Monitor

D.

Network Prevent for Web

Buy Now
Questions 27

A DLP administrator created a new agent configuration for an Endpoint server. However, the endpoint agents fail to receive the new configuration.

What is one possible reason that the agent fails to receive the new configuration?

Options:

A.

The new agent configuration was saved but not applied to any endpoint groups.

B.

The new agent configuration was copied and modified from the default agent configuration.

C.

The default agent configuration must be disabled before the new configuration can take effect.

D.

The Endpoint server needs to be recycled so that the new agent configuration can take effect.

Buy Now
Questions 28

A DLP administrator has performed a test deployment of the DLP 15.0 Endpoint agent and now wants to uninstall the agent. However, the administrator no longer remembers the uninstall password.

What should the administrator do to work around the password problem?

Options:

A.

Apply a new global agent uninstall password in the Enforce management console.

B.

Manually delete all the Endpoint agent files from the test computer and install a new agent package.

C.

Replace the PGPsdk.dll file on the agent’s assigned Endpoint server with a copy from a different Endpoint server

D.

Use the UninstallPwdGenerator to create an UninstallPasswordKey.

Buy Now
Questions 29

A DLP administrator needs to stop the PacketCapture process on a detection server. Upon inspection of the Server Detail page, the administrator discovers that all processes are missing from the display.

What are the processes missing from the Server Detail page display?

Options:

A.

The detection server Display Control Process option is disabled on the Server Detail page.

B.

The Display Process Control setting on the Advanced Settings page is disabled.

C.

The detection server PacketCapture process is displayed on the Server Overview page.

D.

The Advanced Process Control setting on the System Settings page is deselected.

Buy Now
Questions 30

Which two technologies should an organization utilize for integration with the Network Prevent products? (choose two.)

Options:

A.

Network Tap

B.

Network Firewall

C.

Proxy Server

D.

Mail Transfer Agent

E.

Encryption Appliance

Buy Now
Questions 31

Which two detection technology options ONLY run on a detection server? (Choose two.)

Options:

A.

Form Recognition

B.

Indexed Document matching (IDM)

C.

Described Content Matching (DCM)

D.

Exact data matching (EDM)

E.

vector Machine Learning (VML)

Buy Now
Questions 32

When Symantec DLP is integrated with Microsoft Purview Information Protection (MPIP, also previously known as MIP), to which content types can the Mac DLP Agent apply MPIP labels (classification tags)?

Options:

A.

Microsoft Word, Excel, and PowerPoint files

B.

Microsoft Word, Excel, and PowerPoint files; and Adobe PDF files

C.

Microsoft Word, Excel, and PowerPoint files; and Microsoft Outlook emails

D.

Microsoft Word, Excel, and PowerPoint files; Microsoft Outlook emails; and Adobe PDF files

Buy Now
Exam Code: 250-587
Exam Name: Symantec Data Loss Prevention 16.x Administration Technical Specialist
Last Update: Aug 8, 2026
Questions: 108

PDF + Testing Engine

$49.5  $164.99

Testing Engine

$37.5  $124.99
buy now 250-587 testing engine

PDF (Q&A)

$31.5  $104.99
buy now 250-587 pdf
dumpsmate guaranteed to pass

24/7 Customer Support

DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.

Site Secure

mcafee secure

TESTED 08 Aug 2026