250-438 Free Practice Test

A DLP administrator determines that the \SymantecDLP\Protect\Incidents folder on the Enforce server contains. BAD files dated today, while other. IDC files are flowing in and out of the \Incidents directory. Only .IDC files larger than 1MB are turning to .BAD files.
What could be causing only incident data smaller than 1MB to persist while incidents larger than 1MB change to .BAD files?

1. A. A corrupted policy was deployed.
2. B. The Enforce server’s hard drive is out of space.
3. C. A detection server has excessive filereader restarts.
4. D. Tablespace is almost full.

Correct Answer: D

What should an incident responder select in the Enforce management console to remediate multiple incidents simultaneously?

1. A. Smart Response on the Incident page
2. B. Automated Response on the Incident Snapshot page
3. C. Smart Response on an Incident List report
4. D. Automated Response on an Incident List report

Correct Answer: B

Which action is available for use in both Smart Response and Automated Response rules?

1. A. Log to a Syslog Server
2. B. Limit incident data retention
3. C. Modify SMTP message
4. D. Block email message

Correct Answer: D

A compliance officer needs to understand how the company is complying with its data security policies over time. Which report should be compliance officer generate to obtain the compliance information?

1. A. Policy report, filtered on date and summarized by policy
2. B. Policy Trend report, summarized by policy, then quarter
3. C. Policy report, filtered on quarter and summarized by policy
4. D. Policy Trend report, summarized by policy, then severity

Correct Answer: A

A DLP administrator needs to stop the PacketCapture process on a detection server. Upon inspection of the Server Detail page, the administrator discovers that all processes are missing from the display. What are the processes missing from the Server Detail page display?

1. A. The Display Process Control setting on the Advanced Settings page is disabled.
2. B. The Advanced Process Control setting on the System Settings page is deselected.
3. C. The detection server Display Control Process option is disabled on the Server Detail page.
4. D. The detection server PacketCapture process is displayed on the Server Overview page.

Correct Answer: B
Reference: https://support.symantec.com/content/unifiedweb/en_US/article.TECH220250.html