Symantec Data Loss Prevention 16.x Administration Technical Specialist
Last Update May 30, 2026
Total Questions : 100
We are offering FREE 250-587 Symantec exam questions. All you do is to just go and sign up. Give your details, prepare 250-587 free exam questions and then go for complete pool of Symantec Data Loss Prevention 16.x Administration Technical Specialist test questions that will help you more.
How should a DLP administrator change a policy so that it retains the original file when an endpoint incident has detected a “cope to USB device” operation?
Which two factors are common sources of data leakage where the main actor is well-meaning insider? (Choose two.)
What detection server type requires a minimum of two physical network interface cards?
How should a DLP administrator exclude a custom endpoint application named “custom_app.exe” from being monitoring by Application File Access Control?
What is the Symantec recommended order for stopping Symantec DLP services on a Windows Enforce server?
A DLP administrator needs to stop the PacketCapture process on a detection server. Upon inspection of the Server Detail page, the administrator discovers that all processes are missing from the display.
What are the processes missing from the Server Detail page display?
An administrator is unable to log in to the Enforce management console as “sysadmin”. Symantec DLP is configured to use Active Directory authentication. The administrator is a member of two roles: “sysadmin” and “remediator.”
How should the administrator log in to the Enforce console with the “sysadmin” role?
A divisional executive requests a report of all incidents generated by a particular region, summarized by department.
What does the DLP administrator need to configure to generate this report?
Which two automated response rules will be active in policies that include Exact Data Matching (EDM) detection rule? (Choose two.)
Which service encrypts the message when using a Modify SMTP Message response rule?
A DLP administrator has added several approved endpoint devices as exceptions to an Endpoint Prevent policy that blocks the transfer of sensitive data. However, data transfers to these devices are still being blocked.
What is the first action an administrator should take to enable data transfers to the approved endpoint devices?
Which two components can perform a file system scan of a workstation? (Choose two.)
When managing an Endpoint Discover scan, a DLP administrator notices some endpoint computers are NOT completing their scans.
When does the DLP agent stop scanning?
A DLP administrator determines that the \SymantecDLP\Protect\Incidents folder on the Enforce server contains. BAD files dated today, while other. IDC files are flowing in and out of the \Incidents directory. Only .IDC files larger than 1MB are turning to .BAD files.
What could be causing only incident data smaller than 1MB to persist while incidents larger than 1MB change to .BAD files?
How should a DLP administrator change a policy that it retains the original file when an endpoint incident has detected a “copy to USB device” operation?
Which two (2) technologies should an organization utilize for integration with the Network Prevent products? (Choose two.)
Which statement accurately describes where Optical Character Recognition (OCR) components must be installed?
Which option correctly describes the two-tier installation type for Symantec DLP?
What are two reasons an administrator should utilize a manual configuration to determine the endpoint location? (Choose two.)
Which server target uses the “Automated Incident Remediation Tracking” feature in Symantec DLP?
Which action should a DLP administrator take to secure communications between an on-premises Enforce server and detection servers hosted in the Cloud?
Which statement accurately describes where Optical Character Recognition (OCR) On-Premises DLP Core components must be installed?
Which two (2) detection servers are available as virtual appliances? (Choose two.)
Which two detection technology options ONLY run on a detection server? (Choose two.)
Which of the following actions can you implement ONLY as a Smart Response rule (and not as an automates response rule)?
A DLP administrator created a new agent configuration for an Endpoint server. However, the endpoint agents fail to receive the new configuration.
What is one possible reason that the agent fails to receive the new configuration?
TESTED 30 May 2026
