An incident response team has determined that multiple incidents are resulting from the same user action of copying sensitive data to USB devices.
Which action should the incident response team take to fix this issue so only one incident per action is detected?
A. create separate policies for the different detection methods
B. combine multiple conditions into one compound rule
C. change the monitor/ignore filters in the agent configuration
D. change which 'Endpoint Destinations' are monitored
正解:B
質問 2:
Which two products are leveraged for Network Prevent integration? (Select two.)
A. Proxy Server
B. Load Balancer
C. Span Port
D. Network Tap
E. Mail Transfer Agent
正解:A,E
質問 3:
Which two pieces of system information are collected by Symantec Data Loss Prevention Supportability Telemetry? (Select two.)
A. file types for which there are incidents
B. currently installed version of the Enforce Server
C. cumulative statistics regarding network traffic
D. number of system alerts generated daily
E. number of policies currently deployed
正解:A,B
質問 4:
A Network Monitor is showing under System Overview as 'Running Selected'. The corresponding detection server events indicate that packet capture and filereader are crashing.
What is a possible cause for the Network Monitor being in this state?
A. the minimum required amount of available free space has been used
B. the Enforce server and detection server are running different versions
C. the license has expired for this detection server
D. the detection server is missing the server side certificate
正解:A
質問 5:
You are responsible for managing two Storage Foundation 5.0 servers, Srv1 and Srv2. You want to permanently move a disk group from Srv1 to Srv2. However, the Srv2 already has a disk group with the same name. You need to move the disk group without making modifications to the data on the disks. You also need to ensure that the disk group import is permanent on Srv2.
What should you do?
A. Unmirror and unencapsulate the disk group.
B. Import the disk group and rename it on Srv2.
C. Rename the disk group during deport operation.
D. Import the disk group on Srv2 as is.
正解:C
質問 6:
You have just started a relayout operation in a live test environment, and you want to limit the impact of your work on concurrent testing activities. You also want to accommodate the need to constrain a relayout job's performance impact on concurrent activities.
What would you do to perform this task?
A. Use the "set iodelay" option of vxtask to throttle the VxVM task.
B. Use the "set slow" option of vxtask to throttle the VxVM task.
C. Use the "set nice" option of vxtask to throttle the VxVM task.
D. Use the "set iowait" option of vxtask to throttle the VxVM task.
正解:B
質問 7:
Which two actions should an organization take when deploying Endpoint Prevent according to Symantec best practices? (Select two.)
A. configure, test, and tune filters
B. enable monitoring of the local file system
C. delete the pre-defined filters and create its own
D. enable monitoring of many destinations and protocols simultaneously
E. test the agent on a variety of end-user images
正解:A,E
質問 8:
A DLP administrator needs to have the Email Prevent Server return inspected emails to the same MTA from which it receives the message. In which mode should the Email Prevent server be configured?
A. trial
B. mirror
C. reflect
D. forward
正解:C
江沢** -
大判のテキストで問題も豊富。250-513学習に良い身近なところから順番に学習できるようになっている点も良い点です。