Broadcom Data Loss Prevention Technical Specialist (250-553) Certification Sample Questions

01. Under which circumstances does CloudSOC refer a file for DLP Scanning?
a) When it matches parameters configured in Application Detection Configuration
b) When it matches parameters configured in the Enforce policy
c) When it matches parameters configured in Cloud Detection Service
d) When it matches parameters configured in CloudSOC

02. A Network Monitor server has been installed. The server is receiving traffic but Enforce is NOT showing incidents. Running Wireshark indicates that the desired traffic is reaching the detection server. What is the most likely cause for this behavior?
a) The mirrored port is sending corrupted packets.
b) The wrong interface is selected in the configuration.
c) The configuration is set to process GET requests.
d) The communication with Enforce is interrupted.

03. Which two pieces of system information are collected by Symantec Data Loss Prevention Supportability Telemetry?
(Select two.)
a) Currently installed version of the Enforce Server
b) Number of policies currently deployed
c) Cumulative statistics regarding network traffic
d) File types for which there are incidents
e) Number of system alerts generated daily

04. An incident responder sees basic incident data but is unable to view specific details of the incident. What could be wrong with the configuration in the incident responder's role?
a) View option is selected, and all display attributes are deselected.
b) Incident Access tab conditions are specified.
c) Available Smart Response rules are deselected.
d) Server administration rights are deselected.

05. Which response rule action will be ignored when using an Exact Data Matching (EDM) policy?
a) Network Prevent: Remove HTTP/HTTPS Content
b) All: Send Email Notification
c) Network Protect: Copy File
d) Endpoint Prevent: Notify

06. In which two ways can the default listener port for a detection server be modified?
(Select two.)
a) Through the Enforce user interface under System > Overview
b) By editing the Communication.properties file on a detection server
c) Through the Enforce user interface under Manage > Policies
d) By editing the MonitorController.properties file on a detection server
e) By editing the model.notification.port file on a detection server

07. What Symantec Data Loss Prevention product can monitor and block FTP transmissions?
a) Network Monitor
b) Network Prevent for Web
c) Network Prevent for Email
d) Network Discover

08. An organization wants to implement Endpoint Prevent and Endpoint Discover for 120,000 endpoint computers using transient connections. What is the minimum number of Endpoint Servers that an organization would need to install?
a) 4
b) 6
c) 8
d) 10

09. Which two incident conditions are available to configure Automated Response Rules?
(Select two.)
a) Incident Status
b) Sender Groups
c) Protocol or Endpoint Destination
d) Incident Match Count
e) File Size

10. Which detection method should a DLP Administrator utilize to block files containing credit card numbers from being transferred from an endpoint computer to an external USB drive?
a) Keywords
b) Exact Data Matching
c) Data Identifier
d) Vector Machine Learning