[Q29-Q45] 250-587 Certification – The Ultimate Guide [Updated 2026]

Section	Weight	Objectives
Topic 1: Policy Management	25%	– Content Matching Rules – Policy Development Lifecycle – Fingerprints and Document Matching – Incident Response Rules – Policy Builder and Templates – Exception Rules – Data Identifiers and Dictionaries
Topic 2: Overview and Architecture	12%	– Network Architecture and Topology – DLP Architecture and Components – Endpoint Architecture – Detection Server Types and Functions – Enforce Server Architecture
Topic 3: System Administration and Maintenance	3%	– User and Role Management – Performance Monitoring – System Backup and Restore – Logs and Diagnostics
Topic 4: Endpoint Administration	15%	– Endpoint User Rules – Endpoint Blocking and Monitoring – Endpoint Troubleshooting – Endpoint Deployment – Endpoint Policies
Topic 5: Installation and Configuration	15%	– Detection Server Installation – High Availability Setup – SSL/TLS Configuration – Enforce Server Installation – LDAP and Directory Integration – Database Configuration
Topic 6: Incident Management	20%	– Incident Reporting and Dashboards – Incident Response Actions – Incident Remediation – Incident Workflow and Lifecycle – Incident Forensics – Custom Incident Attributes
Topic 7: Network Prevention	10%	– Protocol Drivers – Network Prevent for Mail – Network Prevent for Web – Network Monitor Configuration

NEW QUESTION 29
You are managing a Storage Foundation 5.0 server that has Storage Foundation Management Server (SFMS) software installed. You force a placement policy to a file system using the Storage Foundation Management Server (SFMS). What is the outcome when a policy is forced to a file system?

The current policies of the file system are overwritten by the SFMS policies.

The file system will retain its policies and discard the SFMS policies.

The file system will incorporate the changes of both the policies.

The file system will apply the SFMS policies only in the case where its own policies cannot be assigned.

NEW QUESTION 30
You have large number of mirrored volumes, and the resynchronization process on mirrored volumes will take lot of time. You want to address enable Dirty Region Logging (DRL) and find out the cause why it takes a long time for resynchronization. You want to check the status of DRL logging to see if it is already enabled. How will you accomplish this task?

Use the vxprint command with the -F%drllogging $DCOVOL option

Use the vxprint command with the -F%drllogging $DRLVOL option

Use the vxprint command with the -F%dcologging $DCOVOL option

Use the vxprint command with the -F%drllogging $$DCONAME option

NEW QUESTION 31
Which is a limitation of using CDS disk layout under VxVM 4.0 or above?

The CDS format cannot contain a private region and a public region on a single partition.

The CDS format cannot be used with hardware RAID controllers.

The CDS format cannot be used in conjunction with OS-level partitioning.

The CDS format cannot be used for boot disks.

NEW QUESTION 32
A user is unable to log in as sysadmin. The Data Loss Prevention system is configured to use Active Directory authentication. The user is a member of two roles: sysadmin and remediator. How should the user log in to the user interface in the sysadmin role?

sysadminusername@domain

sysadminusername

domainusername

usernamesysadmin

NEW QUESTION 33
What should an incident responder select to remediate multiple incidents simultaneously?

Smart Response on the Incident Snapshot page

Automated Response on an Incident List report

Smart Response on an Incident List report

Automated Response on the Incident Snapshot page

NEW QUESTION 34
Which automated response action can be performed for data loss incidents caused by confidential data found on Windows shares?

Block Message

Quarantine File

User Cancel

Notify User

NEW QUESTION 35
You administer storage for an application “myapp” on server QA1, with a file system dedicated to code and configuration data for that myapp. Part of the testing discipline is to return myapp’s file system to a known initial state prior to each test activity, and to run a series of tests beginning with the same initial state. The traditional approach to preparing for each test involves restoring the file system from a backup image prior to each test, which imposes an hour’s delay between the end of one test run and the beginning of the next. A typical testing session lasts only two to three hours, the hour of restore delay between tests reduces the availability of the server for testing by about 30%. What kind of Storage Foundation mechanism would work best to reduce the delay required between tests?

Third-mirror breakoff snapshots are the best fit.

Space-optimized instant snapshots are the best fit.

File system snapshots are the best fit.

Storage checkpoints are the best fit.

NEW QUESTION 36
A company needs to secure the content of all mergers and Acquisitions Agreements/ However, the standard text included in all company literature needs to be excluded.
How should the company ensure that this standard text is excluded from detection?

Create a Whitelisted.txt file after creating the Vector Machine Learning (VML) profile.

Create a Whitelisted.txt file after creating the Exact Data Matching (EDM) profile

Create a Whitelisted.txt file before creating the Indexed Document Matching (IDM) profile

Create a Whitelisted.txt file before creating the Exact Data Matching (EDM) profile

NEW QUESTION 37
A DLP administrator created a new agent configuration for an Endpoint server. However, the endpoint agents fail to receive the new configuration.
What is one possible reason that the agent fails to receive the new configuration?

The new agent configuration was saved but not applied to any endpoint groups.

The new agent configuration was copied and modified from the default agent configuration.

The default agent configuration must be disabled before the new configuration can take effect.

The Endpoint server needs to be recycled so that the new agent configuration can take effect.

NEW QUESTION 38
You have executed the vxdg -g diskgroup adddisk disk_name= command. Which switch needs to be added to force VxVM to take the disk media name of the failed disk and assign it to the new replacement disk?

-force

-k

-f

-assign

NEW QUESTION 39
You move a set of files from a VxFS file system to another file system. When the files are moved, the extent attributes are not moved along with the files and are lost during the migration. What could be a possible cause for this problem?

The target file system is not a VxFS type file system.

There is a variation in the block size of source and target VxFS file system.

The target VxFS file system does not have enough free space to accommodate the extent attributes.

The target VxFS file system uses mixed block size.

NEW QUESTION 40
Which two pieces of system information are collected by Symantec Data Loss Prevention Supportability Telemetry? (Select two.)

currently installed version of the Enforce Server

number of policies currently deployed

cumulative statistics regarding network traffic

file types for which there are incidents

number of system alerts generated daily

NEW QUESTION 41
A DLP administrator needs to decide if using Symantec Management Console (SMC) will provide additional functionality over the built-in Agent Actions that can be performed via Agents > Overview > Summary Reports.
What are two of the Agent Actions that can be performed with SMC that are unable to be used with the built-in Agent Actions? (Select two.)

Set Under Investigation

Get Agent Configuration

Toggle Print Screen

Set Log Level

Gather Endpoint detection server logs

NEW QUESTION 42
A DLP administrator needs to improve the reporting performance of the Symantec Data Loss Prevent deployment by archiving incidents. What happens to incidents as a result of using the Incident Archive Flag feature?

they are moved to offline storage

they are moved from reporting status

they are moved to the archive table

they are moved to the archive database

NEW QUESTION 43
Which two operating systems are supported for Symantec Data Loss Prevention 12 servers? (Select two.)

Windows 2003 Enterprise Edition 64-bit

Red Hat Linux 5 Enterprise 64-bit

Windows 2008 Server 32-bit

Red Hat Linux 6 Enterprise 64-bit

Windows 2008 R2 Enterprise Edition 64-bit

NEW QUESTION 44
You are managing a Storage Foundation 5.0 using Storage Foundation Management Server on Solaris 10. You need to manage hosts with different domain names from the Storage Foundation Management Server. What should you do?

Modify the hosts file in the /etc directory.

Modify the resolv.conf in the /etc directory.

Modify the nsswitch.conf in the /etc directory.

Modify the system in the /etc directory.

NEW QUESTION 45
A customer needs to integrate information from DLP incidents into external Governance, Risk and Compliance dashboards.
Which feature should a third party component integrate with to provide dynamic reporting, create custom incident remediation processes, or support business processes?

Export incidents using the CSV format

Incident Reporting and Update API

Incident Data Views

A Web incident extraction report