Broadcom Data Loss Prevention Administration Technical Specialist (250-587) Certification Sample Questions

01. A lookup plug-in that reads Veritas Data Insight now fills Data Owner Name on Network Discover incidents. Data Owner Email stays empty, so notifications addressed to the data owner reach nobody. Owner mailboxes are recorded in the corporate LDAP directory.
Which configuration fills the missing value?
a) An LDAP lookup plug-in placed ahead of the Data Insight plug-in
b) A second Data Insight plug-in pointed at the LDAP directory
c) An LDAP lookup plug-in keyed on the sender's email address
d) An LDAP lookup plug-in chained after the Data Insight plug-in

02. A retailer's outbound email is run by a managed service provider. The retailer wants its Network Prevent for Email Server placed in the provider's network, across a WAN from its Enforce Server, so that it integrates with the provider's mail servers.
What does this hosted deployment require?
a) A second Enforce Server placed inside the provider's network
b) User-generated certificates in place of the built-in one
c) A SPAN port in the provider's network feeding the server
d) An ICAP service on the provider's mail servers pointing to it

03. Network Discover scans have found violating files across thousands of locations on the company's Windows file servers. The remediation team can work through only part of them this quarter and wants to cut exposure as quickly as possible.
Which report is designed to point that effort where the most sensitive data and the highest risk of exposure are?
a) The Folder Risk Report
b) A Discover summary of incidents by status
c) The Network Executive Summary
d) The User Risk Summary

04. A bank remediates quarantined-email incidents through the Symantec DLP app on ServiceNow. For a handful of users, incident assignment fails, while it works for their colleagues.
What should the administrator check first?
a) Whether the remediation rules carry a Severity condition
b) Whether a separate DLP license for remediation is installed
c) Whether they hold the remediator role in the ServiceNow app
d) Whether their addresses appear in the Enforce SMTP settings

05. A Network Discover scan of a production SQL database has to run during business hours. The database team wants the scan to place only a light, steady load on the database so that it does not compete with the application's own queries.
Which target setting meets this requirement?
a) Inventory Mode with a low incident threshold
b) A schedule that pauses the scan during set hours
c) A second Network Discover Server sharing the target
d) Throttling by rows per minute

06. An Endpoint Discover scan was started across all of a consultancy's laptops while every one of them was connected. Most laptops finished within a day. Several consultants then disconnected to travel, and a week later the scan still shows as running.
What explains the scan status?
a) The scan finishes only once every endpoint completes or times out
b) Disconnected laptops pause their scans until they reconnect to an Endpoint Server
c) The agents are also working through the laptops' mapped network drives
d) Enforce must collect each laptop's results directly

07. A bank's merger code name, Harbor, is also an ordinary word that turns up in many harmless messages. The security team wants a match only when Harbor appears close to words such as acquisition or valuation.
Which detection condition fits this requirement?
a) A keyword dictionary listing Harbor alongside the deal terms
b) A compound rule pairing Harbor with a deal keyword
c) A keyword proximity condition linking Harbor with the deal terms
d) A data identifier with a validator for the code name

08. A regional compliance office wants one report filter that covers every incident still being worked, whether it is New, under Investigation or Escalated, without picking each status by hand.
What should the administrator define?
a) A custom attribute that records the open state
b) A policy group for open work
c) A double summary report by status
d) A status group

09. In Symantec's description of who uses DLP reporting, an executive is responsible for overall risk reduction and communicates priorities to policy authors and incident responders.
Which reports does that executive typically monitor?
a) Incident snapshots for a single department or location
b) Dashboards and summary reports
c) Detection server configuration settings
d) Response rule settings for each policy

10. Remediators typed a Cost Center value into a custom attribute on several hundred incidents. An administrator later re-ran Lookup on the same incidents, and the plug-in returned no Cost Center for most of them. The values the remediators entered are now blank.
What explains this?
a) Re-running Lookup overwrites the values, even with empty results
b) A Set Status action in a Smart Response rule reset the attributes
c) Display attributes on the role now hide the custom attribute
d) Incident hiding removed the values from those incidents