250-438 Online Practice Questions and Answers

What is the correct configuration for "BoxMonitor.Channels" that will allow the server to start as a Network Monitor server?

A. Packet Capture, Span Port

B. Packet Capture, Network Tap

C. Packet Capture, Copy Rule

D. Packet capture, Network Monitor

Under the "System Overview" in the Enforce management console, the status of a Network Monitor detection server is shown as "Running Selected." The Network Monitor server's event logs indicate that the packet capture and filereader processes are crashing.

What is a possible cause for the Network Monitor server being in this state?

A. There is insufficient disk space on the Network Monitor server.

B. The Network Monitor server's certificate is corrupt or missing.

C. The Network Monitor server's license file has expired.

D. The Enforce and Network Monitor servers are running different versions of DLP.

Which product is able to replace a confidential document residing on a file share with a marker file explaining why the document was removed?

A. Network Discover

B. Cloud Service for Email

C. Endpoint Prevent

D. Network Protect

Which detection method depends on "training sets"?

A. Form Recognition

B. Vector Machine Learning (VML)

C. Index Document Matching (IDM)

D. Exact Data Matching (EDM)

A DLP administrator has added several approved endpoint devices as exceptions to an Endpoint Prevent policy that blocks the transfer of sensitive data. However, data transfers to these devices are still being blocked. What is the first action an administrator should take to enable data transfers to the approved endpoint devices?

A. Disable and re-enable the Endpoint Prevent policy to activate the changes

B. Double-check that the correct device ID or class has been entered for each device

C. Verify Application File Access Control (AFAC) is configured to monitor the specific application

D. Edit the exception rule to ensure that the "Match On" option is set to "Attachments"

A divisional executive requests a report of all incidents generated by a particular region, summarized by department. What does the DLP administrator need to configure to generate this report?

A. Custom attributes

B. Status attributes

C. Sender attributes

D. User attributes

A company needs to secure the content of all Mergers and Acquisitions Agreements However, the standard text included in all company literature needs to be excluded. How should the company ensure that this standard text is excluded from detection?

A. Create a Whitelisted.txt file after creating the Vector Machine Learning (VML) profile.

B. Create a Whitelisted.txt file after creating the Exact Data Matching (EDM) profile

C. Create a Whitelisted.txt file before creating the Indexed Document Matching (IDM) profile

D. Create a Whitelisted.txt file before creating the Exact Data Matching (EDM) profile

Which statement accurately describes where Optical Character Recognition (OCR) components must be installed?

A. The OCR engine must be installed on detection server other than the Enforce server.

B. The OCR server software must be installed on one or more dedicated (non-detection) Linux servers.

C. The OCR engine must be directly on the Enforce server.

D. The OCR server software must be installed on one or more dedicated (non-detection) Windows servers.

Which action is available for use in both Smart Response and Automated Response rules?

A. Log to a Syslog Server

B. Limit incident data retention

C. Modify SMTP message

D. Block email message

Which service encrypts the message when using a Modify SMTP Message response rule?

A. Network Monitor server

B. SMTP Prevent

C. Enforce server

D. Encryption Gateway