Symantec Symantec Certified Security program ST0-237 Questions & Answers

• Question 331:

  A DLP administrator needs to modify a Network Discover scan that has started.

  How should the administrator ignore files larger than 20 MB for the remaining shares?

  A. Pause the scan, edit the scan target filters to ignore files greater than 20 MB, resume the scan

  B. Modify the server settings for the Discover server running the scan, adjust the maxfilesize.level setting to greater than 20 MB, restart the Discover server

  C. Stop the Vontu Monitor Controller Service, go to Manage > Discover Scanning > Discover Targets, set a new filter, restart the service

  D. Create a new scan with updated file size filters and start the scan

  Correct Answer: A

• Question 332:

  Which valid automated response option should an administrator choose for Email Prevent?

  A. Modify the message subject or add specific RFC-2822 headers

  B. Add metadata to email headers of confidential email

  C. Modify the body of email messages containing confidential data

  D. Process confidential email re-routed to a specified email list

  Correct Answer: A

• Question 333:

  A DLP administrator needs to have the Email Prevent Server return inspected emails to the same MTA from which it receives the message. In which mode should the Email Prevent server be configured?

  A. forward

  B. reflect

  C. mirror

  D. trial

  Correct Answer: B

• Question 334:

  The VxVM operation fails while importing a disk group and you get an error message "VxVM vxdg ERROR V-5-1-2907 diskgroup: Disk group does not exist"

  How will you solve this problem?

  A. Export a disk group from another host.

  B. Export a disk group from the current host and import the disk group to another host.

  C. If the disk group already exists on the exported host, import it to the current host.

  D. Restore the configuration for the disk group from the backup.

  Correct Answer: C

• Question 335:

  Which server encrypts the message when using a Modify SMTP Message response rule?

  A. Encryption Gateway

  B. SMTP Prevent server

  C. Network Monitor server

  D. Enforce server

  Correct Answer: C

• Question 336:

  An administrator implements a policy to block confidential data from being posted to Facebook. The policy generates incidents but allows the content to be posted. Which action should the administrator take to resolve this issue?

  A. Turn off Trial mode

  B. Turn on default settings

  C. Enable Get Processing

  D. Enable ICAP.Allowhosts

  Correct Answer: A

• Question 337:

  Refer to the exhibit.

  

  An administrator needs to implement a Mobile Email Monitor solution to inspect corporate emails on mobile devices. Where should the administrator place the web proxy?

  A. 1

  B. 2

  C. 3

  D. 4

  Correct Answer: B

• Question 338:

  An administrator needs to deploy a Symantec Data Loss Prevention solution that will monitor network traffic. Which traffic type is excluded from inspection when using the default configuration?

  A. HTTP-get

  B. NNTP

  C. FTP-put

  D. HTTP-post

  Correct Answer: A

• Question 339:

  Which incidents appear in the Network Incident List report when the Network Prevent Action filter is set to Modified?

  A. incidents in which confidential content was removed from the body of an SMTP email

  B. incidents in which an SMTP email was changed to include one or more SMTP headers

  C. incidents in which digital rights were applied to SMTP email attachments containing confidential information

  D. incidents in which confidential attachments were removed from an SMTP email

  Correct Answer: B

• Question 340:

  Which automated response action can be performed for data loss incidents caused by confidential data found on Windows shares?

  A. Block Message

  B. Quarantine File

  C. User Cancel

  D. Notify User

  Correct Answer: B