The correct selections are Regular expressions and Classification tags . In Forcepoint DSPM pattern matching, a pattern is built around a RegEx , meaning the text sequence or structure the system searches for during file scans. Forcepoint defines RegEx as “a sequence or pattern that is searched for in text,” and defines a pattern as the RegEx plus the rules associated with its detection. That makes regular expressions the core detection mechanism for custom pattern matching.

Classification tags are also a key configuration component because they define how matching files should be labelled after the pattern is detected. In the Add New Pattern workflow, Forcepoint lists Classifications as a configurable field and describes it as the “Classification tagset value.” The same workflow states that selected Classification, Compliance, and Distribution values override machine-learning model output during endpoint suggestions and file scans.

The remaining options are not primary pattern-matching configuration components. Applicable Country is not listed as a core pattern field in the documented pattern workflow. User credentials belong to identity and access management, not detection logic. Data sensitivity keys is not the documented configuration term used for pattern creation. References/topics: Pattern Matching, RegEx Detection, Classification Tags, Compliance Tags, Distribution Tags, Scan Classification Overrides .

Path Detectors = Monitor storage locations of sensitive data

Content Detectors = Analyze data within files for sensitive data

Attribute Detectors = Identify meta-data within documents

Forcepoint DSPM separates detector logic into path, content, and attribute-based functions so classification can be driven by where data is stored, what the file contains, and what scan-derived attributes describe the file. Path Detectors evaluate file path information, including directory location, filename, and extension. Forcepoint describes them as identifying and classifying files based on directory location and file extensions, which aligns with monitoring storage locations where sensitive data resides.

Content Detectors inspect the actual contents of files. Forcepoint states that content detectors analyze file content and categorize based on keywords, phrases, positive and negative terms, or patterns, making them the correct match for analyzing data within files for sensitive data.

Attribute Detectors operate on scan-result attributes rather than raw text content alone. Forcepoint describes them as defining criteria for “critical” and “sensitive” based on attributes in scan results, including ML output or path/content detector hits. This maps most closely to identifying metadata or scan-derived characteristics within documents. References/topics: Detectors, Path Detectors, Content Detectors, Attribute Detectors, AI Mesh, Classification Model .

Export a Dashboard in PDF format → For analysis by other users

Export a Dashboard in JSON format → To duplicate a dashboard in another Forcepoint DSPM deployment

Export Enterprise Search results in CSV format → To import data into a spreadsheet or database

Export Enterprise Search results in JSONL format → To import data into a SIEM solution

Forcepoint DSPM uses different export formats for different operational purposes. A Dashboard PDF export is intended for human-readable sharing, review, and offline analysis. PDF is best when the dashboard needs to be distributed to managers, auditors, analysts, or department stakeholders who need a static visual report rather than a reusable configuration object. Forcepoint documents dashboard export capability as supporting PDF and JSON export from the dashboard interface.

A Dashboard JSON export preserves the dashboard definition rather than just the visual output. This makes JSON the correct format when the goal is to duplicate or migrate a dashboard into another Forcepoint DSPM deployment, because the dashboard structure, layout, panels, widgets, and configuration can be reused.

For Enterprise Search , CSV is the correct format for spreadsheet or database workflows. CSV is tabular, broadly compatible, and suited for Excel-style analysis, reporting, joins, and external data review. Forcepoint documents Enterprise Search export as producing CSV or JSON downloads of filtered data.

JSONL is most appropriate for SIEM ingestion because each line can represent an individual structured event or record, making it easier for log pipelines and event-processing systems to parse at scale. References/topics: Analytics Export, Dashboard Export, Enterprise Search Export, CSV, JSON/JSONL, SIEM Integration .

The correct answers are B and C . Forcepoint DSPM pattern matching is used to identify specific information inside documents during scans. Forcepoint defines pattern matching as functionality that identifies “particular pieces of information in a document” by using regular expressions that match file content. A credit-card-like numeric string is a direct fit because it represents structured sensitive data that can be detected using a predictable format and then associated with compliance obligations such as PCI-related handling.

Option C is also valid because Forcepoint DSPM supports custom identification of sensitive business data, including intellectual property and trade secrets. A regular expression can be configured to detect proprietary product identifiers, engineering codes, project names, or other technical markers associated with confidential product development. Forcepoint’s pattern terminology defines a Pattern as the RegEx plus the rules associated with detection, and allows classification, compliance, and distribution tags to be applied when the pattern is detected.

Options A , D , and E describe general regex use cases outside Forcepoint DSPM pattern matching. They focus on scripting, log parsing, and web-form validation rather than data discovery, classification, and governance. References/topics: Pattern Matching, RegEx, Classification Tags, Compliance Tags, Sensitive Data Discovery .

Administration > Taxonomy

Taxonomy tags are managed from the Administration menu, specifically under Administration > Taxonomy . In the screenshot, Adam should not select Policy Center ; the currently open menu shows Compliance Hub, Data Register, Controls Orchestration, and Incidents, but taxonomy management is not located there. The correct UI action is to open the Administration drop-down on the top navigation bar and select Taxonomy .

Forcepoint’s DSPM documentation states that the Taxonomy page displays predefined AI Mesh tags, which cannot be removed, and also allows administrators to add custom tags for pattern matching and detection rules. It further explains that taxonomy mapping can connect AI Mesh tags with data-source taxonomies so mapped tags can be written back as the organization’s own labels.

This location is important because taxonomy governs the classification language DSPM applies to scanned data. By updating taxonomy tags, Adam aligns DSPM classification output with the company’s internal handling policies, sensitivity labels, and compliance terminology. Forcepoint also notes that new taxonomy tags are created from the Taxonomy tab under the Administration section, and that applied tags are visible in the Data Asset Inventory. References/topics: Administration, Taxonomy, AI Mesh Tags, Classification Tags, Pattern Matching, Detection Rules .

Correct order: 3 → 2 → 6 → 5 → 4 → 1

Navigate to Administration > User Management .

Set realm to gv .

Select Users , then Add user .

Fill in the necessary user information.

Select Join Groups .

Select Administrators .

Forcepoint DSPM user administration for a standalone deployment is performed through the Keycloak-based user management workflow. The sequence begins by entering the DSPM administration area and opening User Management , which places the administrator in the identity-management context used to control DSPM UI access. The next critical step is selecting the gv realm. Forcepoint documentation specifically instructs administrators to select the gv realm after logging into Keycloak and warns against changing settings in the Master realm, because the DSPM application authorization model is tied to the gv realm rather than the default administrative realm.

After the correct realm is active, the administrator creates the account by selecting Users , choosing Add user , and entering required identity fields such as username, email, first name, and last name. Once the user object exists, access is completed through RBAC group membership. Forcepoint’s RBAC guidance recommends group-based role assignment: navigate to the user, open the Groups area, search/select the appropriate group, and click Join . Selecting Administrators grants the required administrative group membership and resulting DSPM access.

The correct selections are Rule-Based Automation, Incident Management, Webhook Notification System, and Workflow Configuration Tool . Forcepoint DSPM Controls Orchestration is built around rules that identify data requiring attention and can trigger notifications or automated responses. The official documentation describes Controls Orchestration as providing “automated work flows, rule-based detection, timely notifications, and efficient incident management,” which directly maps to these four options.

Rule-Based Automation is represented by custom rules that evaluate datasets such as files, trustees, or agent activities using GQL conditions. Workflow Configuration Tool is reflected in the rule-building process under Policy Center > Controls Orchestration , where administrators create rules, define ownership, select the asset, configure conditions, and enable the rule.

Webhook Notification System is valid because orchestration rules can send notifications outside Forcepoint DSPM, and webhook functionality sends HTTP requests to a configured callback endpoint when a defined condition is met. Incident Management is also core because each rule is automatically added as a card in the Incidents tab, linking detected conditions to operational review and response. Rule-Based Remediation is not the best answer here because remediation is an outcome of automated response workflows, not the named key feature in this option set. References/topics: Controls Orchestration, GQL Rules, Webhooks, Incidents, Policy Center .