Pre-Summer Sale - 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dm70dm

250-587 Symantec Data Loss Prevention 16.x Administration Technical Specialist Questions and Answers

Questions 4

A DLP administrator is testing Network Prevent for Web functionality. When the administrator posts a small test file to a cloud storage website, no new incidents are reported.

What should the administrator do to allow incidents to be generated against this file?

Options:

A.

Change the “Ignore requests Smaller Than” value to 1

B.

Add the filename to the Inspect Content Type field

C.

Change the “PacketCapture.DISCARD_HTTP_GET” value to “false”

D.

Uncheck trial mode under the ICAP tab

Buy Now
Questions 5

What is the Symantec recommended order for stopping Symantec DLP services on a Windows Enforce server?

Options:

A.

Vontu Notifier, Vontu Incident Persister, Vontu Update, Vontu Manager, Vontu Monitor Controller

B.

Vontu Update, Vontu Notifier, Vontu Manager, Vontu Incident Persister, Vontu Monitor Controller

C.

Vontu Incident Persister, Vontu Update, Vontu Notifier, Vontu Monitor Controller, Vontu Manager.

D.

Vontu Monitor Controller, Vontu Incident Persister, Vontu Manager, Vontu Notifier, Vontu Update.

Buy Now
Questions 6

Which two (2) detection technology options run on the DLP agent? (Choose two.)

Options:

A.

Indexed Document Matching (IDM)

B.

Directory Group Matching (DGM)

C.

Described Content Matching (DCM)

D.

Optical Character Recognition (OCR)

E.

Form Recognition

Buy Now
Questions 7

Which of the following would have to be a custom attribute (and not an out-of -the-box system attribute) in incident snapshots?

Options:

A.

Network Prevent Action

B.

Endpoint Location

C.

Employee Phone Number

D.

See Before

Buy Now
Questions 8

Which two (2) technologies should an organization utilize for integration with the Network Prevent products? (Choose two.)

Options:

A.

Mail Transfer Agent

B.

Network Tap

C.

Proxy Server

D.

Network Firewall

E.

Encryption Appliance

Buy Now
Questions 9

Which server target uses the “Automated Incident Remediation Tracking” feature in Symantec DLP?

Options:

A.

File System High-Speed Discovery

B.

File System (standard)

C.

SharePoint

D.

Exchange

Buy Now
Questions 10

How should a DLP administrator change a policy that it retains the original file when an endpoint incident has detected a “copy to USB device” operation?

Options:

A.

Add a “Limit Incident Data Retention” response rule with “Retain Original Message” option selected

B.

Modify the agent configuration and select the option “Retain Original Files”

C.

Modify the agent config.db to include the file

D.

Modify the “Endpoint_Retain_Files.int” setting in the Endpoint server configuration

Buy Now
Questions 11

Which two detection technology options run on the DLP agent? (Choose two.)

Options:

A.

Optical Character Recognition (OCR)

B.

Described Content Matching (DCM)

C.

Directory Group Matching (DGM)

D.

Form Recognition

E.

Indexed Document Matching (IDM)

Buy Now
Questions 12

Which two detection servers are available as virtual appliances? (Choose two.)

Options:

A.

Network Monitor

B.

Network Prevent for Web

C.

Network Discover

D.

Network Prevent for Email

E.

Optical Character Recognition (OCR)

Buy Now
Questions 13

How should a DLP administrator exclude a custom endpoint application named “custom_app.exe” from being monitoring by Application File Access Control?

Options:

A.

Add “custom_app.exe” to the “Application Whitelist” on all Endpoint servers.

B.

Add “custom_app.exe” Application Monitoring Configuration and de-select all its channel options.

C.

Add “custom_app_.exe” as a filename exception to the Endpoint Prevent policy.

D.

Add “custom_app.exe” to the “Program Exclusion List” in the agent configuration settings.

Buy Now
Questions 14

Which two DLP products support the new Optical Character Recognition (OCR) engine in Symantec DLP 15.0? (Choose two.)

Options:

A.

Endpoint Prevent

B.

Cloud Service for Email

C.

Network Prevent for Email

D.

Network Discover

E.

Cloud Detection Service

Buy Now
Questions 15

A customer needs to integrate information form DLP incidents into external Governance, Risk, and Compliance dashboards.

Which feature should a third-party component integrate with to provide dynamic reporting, create custom incident remediation processes, or support business processes?

Options:

A.

Incident Reporting and Update API

B.

Export incidents using the CSV format

C.

A web incident extraction report

D.

Incident Data Views

Buy Now
Questions 16

A compliance officer needs to understand how the company is complying with its data security policies over time.

Which report should be compliance officer generate to obtain the compliance information?

Options:

A.

Policy report, filtered on date and summarized by policy

B.

Policy Trend report, summarized by policy, then quarter

C.

Policy report, filtered on quarter and summarized by policy

D.

Policy Trend report, summarized by policy, then severity

Buy Now
Questions 17

Which service encrypts the message when using a Modify SMTP Message response rule?

Options:

A.

Network Monitor server

B.

SMTP Prevent

C.

Enforce server

D.

Encryption Gateway

Buy Now
Questions 18

Why would an administrator set the Similarity Threshold to zero when testing and tuning a Vector Machine Learning (VML) profile?

Options:

A.

To capture the matches to the Negative set

B.

To capture the matches to the Positive set

C.

To see the entire range of potential matches

D.

To see the false negatives only

Buy Now
Questions 19

Which statement accurately describes where Optical Character Recognition (OCR) On-Premises DLP Core components must be installed?

Options:

A.

The OCR engine must be installed directly on the Enforce server.

B.

The OCR engine must be installed on one or more detection servers.

C.

The OCR server software must by installed on one or more dedicated (non-detection) Windows servers.

D.

The OCR server software must be installed on one or more dedicated (non-detection) Linux servers.

Buy Now
Questions 20

Which statement accurately describes where Optical Character Recognition (OCR) components must be installed?

Options:

A.

The OCR engine must be installed on detection server other than the Enforce server.

B.

The OCR server software must be installed on one or more dedicated (non-detection) Linux servers.

C.

The OCR engine must be directly on the Enforce server.

D.

The OCR server software must be installed on one or more dedicated (non-detection) Windows servers.

Buy Now
Questions 21

Which two (2) actions are available for a “Network Prevent: Remove HTTP/HTTPS content” response rule when the content is unable to be removed? (Choose two.)

Options:

A.

Redirect the content to an alternative destination

B.

Block the content from being posted

C.

Encrypt the content before posting

D.

Remove the content through FlexResponse

E.

Allow the content to be posted

Buy Now
Questions 22

What should an incident responder select in the Enforce management console to remediate multiple incidents simultaneously?

Options:

A.

Smart response on the Incident page

B.

Automated Response on the Incident Snapshot page

C.

Smart response on an Incident List report

D.

Automated response on an Incident List report

Buy Now
Questions 23

A DLP administrator needs to remove an agent and its associated events from an Endpoint server.

Which Agent Task should the administrator perform to disable the agent’s visibility in the Enforce management console?

Options:

A.

Delete action from the Agent List page

B.

Disable action from Symantec Management Console

C.

Change Endpoint Server action from the Agent Overview page

D.

Delete action from the Agent Health dashboard

Buy Now
Questions 24

A customer needs to integrate information from DLP incidents into external Governance, Risk and Compliance dashboards.

Which feature should a third party component integrate with to provide dynamic reporting, create custom incident remediation processes, or support business processes?

Options:

A.

Export incidents using the CSV format

B.

Incident Reporting and Update API

C.

Incident Data Views

D.

A Web incident extraction report

Buy Now
Questions 25

Where do you configure the list of Endpoint Servers (or load balancers) to which a DLP Agent can report?

Options:

A.

In the Agent Package

B.

In the Agent Configuration

C.

In the Agent Group

D.

In the Agent Overview

Buy Now
Questions 26

Which two locations can Symantec DLP scan and perform Information Centric Encryption (ICE) actions on? (Choose two.)

Options:

A.

Exchange

B.

Jiveon

C.

File store

D.

SharePoint

E.

Confluence

Buy Now
Questions 27

An administrator is unable to log in to the Enforce management console as “sysadmin”. Symantec DLP is configured to use Active Directory authentication. The administrator is a member of two roles: “sysadmin” and “remediator.”

How should the administrator log in to the Enforce console with the “sysadmin” role?

Options:

A.

sysadmin\username

B.

sysadmin\username@domain

C.

domain\username

D.

username\sysadmin

Buy Now
Questions 28

Which detection server is available from Symantec as a hardware appliance?

Options:

A.

Network Prevent for Email

B.

Network Discover

C.

Network Monitor

D.

Network Prevent for Web

Buy Now
Questions 29

What are two reasons an administrator should utilize a manual configuration to determine the endpoint location? (Choose two.)

Options:

A.

To specify Wi-Fi SSID names

B.

To specify an IP address or range

C.

To specify the endpoint server

D.

To specify domain names

E.

To specify network card status (ON/OFF)

Buy Now
Questions 30

A software company wants to protect its source code, including new source code created between scheduled indexing runs.

Which detection method should the company use to meet this requirement?

Options:

A.

Exact Data Matching (EDM)

B.

Described Content Matching (DCM)

C.

Vector Machine Learning (VML)

D.

Indexed Document Matching (IDM)

Buy Now
Exam Code: 250-587
Exam Name: Symantec Data Loss Prevention 16.x Administration Technical Specialist
Last Update: May 9, 2026
Questions: 100

PDF + Testing Engine

$49.5  $164.99

Testing Engine

$37.5  $124.99
buy now 250-587 testing engine

PDF (Q&A)

$31.5  $104.99
buy now 250-587 pdf
dumpsmate guaranteed to pass

24/7 Customer Support

DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.

Site Secure

mcafee secure

TESTED 10 May 2026