Register
Question 1
Which aspects are included in a DLP policy for testing/validation and incident handling?
Correct Answer:
Testing/validation and incident handling settings
Explanation:
Understanding how a DLP policy works means recognizing that it guides both what you detect and how you test and respond to detections. A DLP policy isn’t just about the detection rules; it also includes how you validate those rules and how the system should react when a match occurs. Testing and validation are essential because you want to confirm that the policy flags the right things and avoids too many false positives or misses. This involves running simulated data or test datasets, evaluating the results, tweaking detection rules, and using test or audit modes to see how the policy would behave in real scenarios before it’s deployed. This step helps ensure the policy actually protects sensitive information without interrupting normal business processes. Incident handling settings specify the actions that happen when a policy detects sensitive data. This includes what to do with the data (block, quarantine, mask, or redact), how to notify people or security teams, how to log the event, and how to create or route an incident or ticket for follow-up. It also covers escalation paths and severities, so responses are timely and appropriate. Choosing only detection rules would miss the necessary testing/validation and the defined responses when a match occurs. Focusing only on remediation actions ignores how you verify policy effectiveness and how you manage incidents. Metadata alone doesn’t address how the policy is tested or how incidents are handled. So, the best answer reflects that a DLP policy includes both testing/validation settings and incident handling settings, ensuring you can verify the policy works and know exactly what happens when it triggers.
Question 2
Which statement about DLP policy exceptions is true?
Correct Answer:
They may be time-bound or permanent and require approver authorization
Explanation:
Exceptions in DLP are controlled bypasses of normal policy actions that you grant only when there’s a legitimate business reason. They can be time-bound (temporary) or permanent, depending on how long you need that exemption, and they must go through an approval workflow with an authorized approver. This setup ensures governance: there’s an explicit authorization, a defined scope, and an auditable record of why and by whom the exception was granted. They’re not applied automatically to all users; exceptions are targeted to specific cases, users, groups, or data types. They also typically require justification as part of the approval process, and they are reviewed and tracked to prevent abuse.
Question 3
Which two automated response rules will be active in policies that include Exact Data Matching detection rule?
Correct Answer:
Endpoint Discover: Quarantine File/Endpoint and Endpoint Prevent: Block
Explanation:
Exact Data Matching detection is used for high-confidence identification of sensitive data, and policies that include EDM are designed to contain the data immediately to stop any leakage. The two active automated responses are to quarantine the file or the endpoint where the match occurred, and to block the endpoint to prevent further access or transmission of that data. Quarantining isolates the identified item so it can’t be opened or moved, while blocking the endpoint enforces a halt to data flow, reducing the risk of exfiltration. Other options like deleting the file, encrypting data, or notifying an admin don’t provide the same immediate containment for EDM-driven policies, so they aren’t the standard pair of automatic responses in this scenario.
Question 4
Which product is able to replace a confidential document residing on a file share with a marker file explaining why the document was removed?
Correct Answer:
Network Protect
Explanation:
Remediation on an on‑premises file share is handled by the component that enforces DLP policies directly at the network/host level. It can take actions on files stored on servers, including replacing a matched confidential document with a marker file that explains why it was removed. That capability is provided by Network Protect, which is designed to enforce policies at the file‑server level and apply remediation actions to files on shares. The other products are focused on discovering sensitive data, protecting data in cloud environments, or monitoring specific cloud storage like Box, and they don’t perform the on‑premises file‑share remediation that replaces a document with a marker.
Question 5
Where in the Enforce management console is the status of a Network Monitor detection server displayed as Running Selected?
Correct Answer:
System Overview
Explanation:
System Overview is the dashboard that shows the health and running state of key DLP Enforce components. The status of the Network Monitor detection server is displayed there so you can quickly confirm it’s actively running. The other areas serve different purposes: Event Logs show past events, Administration Console handles admin tasks, and Network Monitor Settings is for configuration, not current status. So the Running status for the detection server is found in System Overview.
Question 1
Exam overview

About this Exam

The Symantec Data Loss Prevention (DLP) certification, now part of the Broadcom software portfolio, validates an IT professional's ability to design, deploy, and manage the Symantec Data Loss Prevention suite. This practice test is specifically designed for security administrators, engineers, and consultants responsible for protecting an organization's sensitive data against accidental or malicious loss. It helps ensure they are equipped with the knowledge and practical understanding required to maintain a robust data protection posture using Symantec tools.

More details

Additional Information

What the Course Entails and Exam Details

This examination covers the core functional areas of the Symantec Data Loss Prevention platform.

Preparation for this exam includes comprehensive study of:

  • Configuring and managing the Symantec DLP Enforce Server.

  • Deploying and administering Symantec DLP detection servers (Network Monitor, Network Prevent, Endpoint Prevent, and Discover).

  • Creating, testing, and tuning DLP policies, including understanding detection methods like EDM (Exact Data Matching) and IDM (Indexed Data Matching).

  • Analyzing and managing incidents and workflows.

  • Configuring agents and monitoring endpoint activity.

  • Reporting and administrative tasks.


What to Expect in the Final Exam

The actual Symantec DLP certification exam is a computer-based, proctored test administered by Broadcom's testing partners.

Here is what you can typically expect:

  • Format: The exam usually consists of multiple-choice and scenario-based questions.

  • Time Limit: Candidates are generally allotted 90 minutes to complete the test.

  • Passing Score: The required passing score is approximately 70% to 72%, though this may vary.

  • Language: The exam is typically offered in English.

  • Result: You will receive your score report immediately upon completion.


How to Study and Exam Centers

Effective preparation is key to succeeding on the Symantec DLP certification.

Study Strategies:

  • Practical Experience: Deep, hands-on experience deploying and configuring the software in a lab or enterprise environment is essential.

  • Review Documentation: Thoroughly study the Symantec DLP Administration Guides, Installation Guides, and Release Notes.

  • Broadcom Training: Official Broadcom training courses on Symantec DLP are highly recommended.

  • Use Practice Tests: Utilize reputable practice tests (like this one) to assess your knowledge gaps and get familiar with the types of questions asked.

Exam Centers: Broadcom's technical certifications are administered globally through Pearson VUE. You can register for the official exam and locate testing centers (or options for online proctoring) directly through the Pearson VUE website.


Job Opportunities from the Course

A Symantec DLP certification validates in-demand data protection skills, opening up numerous career opportunities in cybersecurity.

Job opportunities this certification can unlock include:

  • DLP Engineer / Specialist

  • Cybersecurity Analyst

  • Information Security Administrator

  • Security Operations Center (SOC) Analyst

  • Data Protection Manager

  • Compliance Officer

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.
No fixed duration is currently configured for this quiz.
Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.
Yes. You can retake the practice test again as you continue studying during your available access period.
After your access is confirmed, you can continue into the complete practice exam from this quiz flow.
Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.
Keep studying

Related Questions

CDC Nursing Home Infection Prevention Practice Exam

0 min

CDFA Pest Prevention Plant Regulation Practice Exam

0 min

Army Unit Prevention Leader (UPL) Certification Training Practice Test

0 min

CIW Data Analyst Practice Exam

0 min

The CIW Data Analyst certification validates your proficiency in the entire data analysis lifecycle

0 min

CIW Database Design Specialist Practice Test

0 min