Symantec Symantec Certified Security program ST0-237 Questions & Answers

• Question 121:

  An Endpoint Prevent: Notify response rule is defined in Korean, English, and Chinese (in that order).

  Which pop-up language will a Japanese Windows locale user see?

  A. Korean

  B. Japanese

  C. English

  D. Chinese

  Correct Answer: A

• Question 122:

  Which two benefits does the Policy Module provide? (Select two.)

  A. determines coverage gaps for multiple, overlapped regulatory, industry-specific, or best practices frameworks

  B. lowers the cost of policy creation and maintenance and measures policy knowledge and retention

  C. defines, reviews, and disseminates written policies to end users as mapped to specific measurable controls

  D. integrates the policy compliance process with existing asset management systems

  E. identifies problems within policies or internal controls and prevents policy compliance failure or data breach

  Correct Answer: AC

• Question 123:

  Which two fields are common to all asset types? (Select two.)

  A. Asset Administrator

  B. Confidentiality

  C. Asset Location

  D. Access Vector

  E. Authentication

  Correct Answer: BC

• Question 124:

  On which protocols does Symantec Data Loss Prevention use port-based protocol recognition?

  A. Secure tunnelling protocols

  B. User-defined IP protocols

  C. User-configured TCP protocols

  D. System-defined UDP and TCP protocols

  Correct Answer: C

• Question 125:

  What does Symantec Control Compliance Suite 9.0 use to help organize how and where data is collected?

  A. collections

  B. sites

  C. domains

  D. organizational units

  Correct Answer: B

• Question 126:

  Which two requirements must be met to successfully use Network Monitor on a Windows based detection server? (Select two.)

  A. Wireshark must be installed on the Windows system.

  B. WinPCAP must be installed on the Windows system.

  C. ARP proxy must be enabled to ensure the Windows system captures all traffic.

  D. At least two network interfaces must be available.

  E. The network interface card must support Jumbo frames.

  Correct Answer: BD

• Question 127:

  A test is performed against one or more assets in order to determine a pass or fail status.

  What is this test called?

  A. Standard

  B. Filter

  C. Check

  D. Evaluation

  Correct Answer: C

• Question 128:

  What should be used to detect existing source code information for a customer?

  A. Exact Data Matching (EDM)

  B. Index Document Matching (IDM)

  C. file type rule condition

  D. data identifier rules

  Correct Answer: B

• Question 129:

  An organization needs to determine whether anyone other than the CEO is emailing PDF documents that contain the phrase "Revenue Operating Report". What is the most efficient way to write this policy and generate the fewest false positives?

  A. One rule without conditions and one exception rule

  B. Two rules and one L7 Sender exception

  C. One rule with two conditions and one exception rule

  D. Two rules with one condition each and one exception rule

  Correct Answer: C

• Question 130:

  Which two can a detection server match on with a recipient matches pattern rule? (Select two.)

  A. IP address of a Web server

  B. Windows username

  C. Instant Messaging Name

  D. MAC address

  E. Webmail server URL

  Correct Answer: AE