Question 1

How do Cloud Detection Service and the Enforce server communicate with each other?

Accepted Answer

A)  Enforce initiates communication with Cloud Detection Service, which is expecting connections on port 8100. 
B)  Cloud Detection Service initiates communication with Enforce, which is expecting connections on port 443. 
C)  Cloud Detection Service initiates communication with Enforce, which is expecting connections on port 1443. 
D)  Enforce initiates communication with Cloud Detection Service, which is expecting connections on port 443.

Question 2

In addition to a configured seed, which other characteristic does Symantec Messaging Gateway 10.5 use to create a unique tag for Bounce Attack Prevention?

Accepted Answer

A)  Message ID 
B)  IP address 
C)  Fully qualified hostname 
D)  Date

Question 3

Probe accounts should be created from which source of email addresses?

Accepted Answer

A)  automatically generated using the built-in tool 
B)  addresses of previous employees 
C)  current NDR reports 
D)  invalid recipient lists

Question 4

Refer to the exhibit. Which type of Endpoint response rule is shown?

Accepted Answer

A)  Endpoint Prevent: User Notification 
B)  Endpoint Prevent: Block 
C)  Endpoint Prevent: Notify 
D)  Endpoint Prevent: User Cancel

Question 5

Which two can be used to verify that Symantec Messaging Gateway 10.5 is processing messages? (Select two)

Accepted Answer

A)  view the Message Audit log 
B)  view the Fastpass log 
C)  view message headers 
D)  view the invalid recipients header 
E)  view the Admin Audit log

Question 6

Following the leak of confidential business contracts, a company's Legal department mandates that all outbound communication from the Finance department must be secure at all times. Which two policy strategies can help the messaging administrator accomplish this in Symantec Messaging Gateway 10.5? (Select two.)

Accepted Answer

A)  Deliver message using TLS 
B)  Block direct client access to corporate email servers 
C)  Deliver message with notification 
D)  Deliver message with content encryption 
E)  Configure firewall to only accept outbound SMTP connections from the Symantec Messaging Gateway scanners

Question 7

Which two actions must be taken to allow end-users to create personal Good and Bad Senders lists? (Select two.)

Accepted Answer

A)  add "Hold message in Spam Quarantine" action to Local Bad Senders domains 
B)  check the option "Enable end-user settings for this policy group" 
C)  configure an LDAP source with Authentication and Recipient Validation functions 
D)  configure an LDAP source with Authentication and Routing functions 
E)  configure an LDAP source with Authentication and Address Resolution functions

Question 8

A DLP administrator has enabled and successfully tested custom attribute lookups for incident data based on the Active Directory LDAP plugin. The Chief Information Security Officer (CISO) has attempted to generate a User Risk Summary report, but the report is empty. The DLP administrator confirms the Cisco's role has the "User Reporting" privilege enabled, but User Risk reporting is still not working. What is the probable reason that the User Risk Summary report is blank?

Accepted Answer

A)  Only DLP administrators are permitted to access and view data for high risk users. 
B)  The Enforce server has insufficient permissions for importing user attributes. 
C)  User attribute data must be configured separately from incident data attributed. 
D)  User attributes have been incorrectly mapped to Active Directory accounts.

Question 9

What is required on the Enforce server to communicate with the Symantec DLP database?

Accepted Answer

A)  Port 8082 should be opened 
B)  CryptoMasterKey.properties file 
C)  Symbolic links to .dbf files 
D)  SQL*Plus Client

Question 10

Which server target uses the "Automated Incident Remediation Tracking" feature in Symantec DLP?

Accepted Answer

A)  Exchange 
B)  File System 
C)  Lotus Notes 
D)  SharePoint

Question 11

A DLP administrator determines that the \ SymantecDLP\Protect\Incidents folder on the Enforce server contains. BAD files dated today, while other. IDC files are flowing in and out of the \Incidents directory. Only .IDC files larger than 1MB are turning to .BAD files. What could be causing only incident data smaller than 1MB to persist while incidents larger than 1MB change to .BAD files?

Accepted Answer

A)  A corrupted policy was deployed. 
B)  The Enforce server's hard drive is out of space. 
C)  A detection server has excessive filereader restarts. 
D)  Tablespace is almost full.

Question 12

By default, which port does Symantec Messaging Gateway 10.5 use to retrieve updated spam definitions?

Accepted Answer

A)  389 
B)  443 
C)  8080 
D)  41002

Question 13

When enabling Connection Classification, how many messages must be processed in learning mode before messages can be deferred?

Accepted Answer

A)  5, 000 
B)  10, 000 
C)  20, 000 
D)  50, 000

Question 14

Why is it important for an administrator to utilize the grid scan feature?

Accepted Answer

A)  To distribute the scan workload across multiple network discover servers 
B)  To distribute the scan workload across the cloud servers 
C)  To distribute the scan workload across multiple endpoint servers 
D)  To distribute the scan workload across multiple detection servers

Question 15

What is the correct configuration for "BoxMonitor.Channels" that will allow the server to start as a Network Monitor server?

Accepted Answer

A)  Packet Capture, Span Port 
B)  Packet Capture, Network Tap 
C)  Packet Capture, Copy Rule 
D)  Packet capture, Network Monitor

Question 16

When managing an Endpoint Discover scan, a DLP administrator notices some endpoint computers are NOT completing their scans. When does the DLP agent stop scanning?

Accepted Answer

A)  When the agent sends a report within the "Scan Idle Timeout" period 
B)  When the endpoint computer is rebooted and the agent is started 
C)  When the agent is unable to send a status report within the "Scan Idle Timeout" period 
D)  When the agent sends a report immediately after the "Scan Idle Timeout" period

Question 17

Which tool must a DLP administrator run to certify the database prior to upgrading DLP?

Accepted Answer

A)  Lob_Tablespace Reclamation Tool 
B)  Upgrade Readiness Tool 
C)  SymDiag 
D)  EnforceMigrationUtility

Question 18

Which two automated response rules will be active in policies that include Exact Data Matching (EDM) detection rule? (Choose two.)

Accepted Answer

A)  Endpoint Discover: Quarantine File 
B)  All: Send Email Notification 
C)  Endpoint Prevent: User Cancel 
D)  Endpoint Prevent: Block 
E)  Network Protect: Quarantine File

Question 19

Under the "System Overview" in the Enforce management console, the status of a Network Monitor detection server is shown as "Running Selected." The Network Monitor server's event logs indicate that the packet capture and filereader processes are crashing. What is a possible cause for the Network Monitor server being in this state?

Accepted Answer

A)  There is insufficient disk space on the Network Monitor server. 
B)  The Network Monitor server's certificate is corrupt or missing. 
C)  The Network Monitor server's license file has expired. 
D)  The Enforce and Network Monitor servers are running different versions of DLP.

Question 20

Which action is available for use in both Smart Response and Automated Response rules?

Accepted Answer

A)  Log to a Syslog Server 
B)  Limit incident data retention 
C)  Modify SMTP message 
D)  Block email message

Exam 4: Administration of Symantec ProxySG 6.7