250-438 Symantec Exam Questions and Free Practice Test

Question 7

A software company wants to protect its source code, including new source code created between scheduled indexing runs. Which detection method should the company use to meet this requirement?

A. Exact Data Matching (EDM)

B. Described Content Matching (DCM)

C. Vector Machine Learning (VML)

D. Indexed Document Matching (IDM)

Correct Answer:D
Reference: https://help.symantec.com/cs/DLP15.0/DLP/v100774847_v120691346/Scheduling-remote-indexing?locale=EN_US

Question 8

What is required on the Enforce server to communicate with the Symantec DLP database?

A. Port 8082 should be opened

B. CryptoMasterKey.properties file

C. Symbolic links to .dbf files

D. SQL*Plus Client

Correct Answer:D
Reference: https://www.symantec.com/connect/articles/three-tier-installation-dlp-product

Question 9

How should a DLP administrator change a policy so that it retains the original file when an endpoint incident has detected a “copy to USB device” operation?

A. Add a “Limit Incident Data Retention” response rule with “Retain Original Message” option selected.

B. Modify the agent config.db to include the file

C. Modify the “Endpoint_Retain_Files.int” setting in the Endpoint server configuration

D. Modify the agent configuration and select the option “Retain Original Files”

Correct Answer:A

Question 10

Which channel does Endpoint Prevent protect using Device Control?

A. Bluetooth

B. USB storage

C. CD/DVD

D. Network card

Correct Answer:B
Reference: https://support.symantec.com/en_US/article.HOWTO80865.html#v36651044

Question 11

Which server target uses the “Automated Incident Remediation Tracking” feature in Symantec DLP?

A. Exchange

B. File System

C. Lotus Notes

D. SharePoint

Correct Answer:B
Reference: https://help.symantec.com/cs/DLP15.0/DLP/v83981880_v120691346/Troubleshooting-automated-incident-remediation-tracking?locale=EN_US

Question 12

Refer to the exhibit.
250-438 dumps exhibit
What activity should occur during the baseline phase, according to the risk reduction model?

A. Define and build the incident response team

B. Monitor incidents and tune the policy to reduce false positives

C. Establish business metrics and begin sending reports to business unit stakeholders

D. Test policies to ensure that blocking actions minimize business process disruptions

Correct Answer:C

START 250-438 EXAM