EMT Practice Test

1. Question Content...

---

Question1: Which two detection technology options ONLY run on a detection server? (Choose two.)

Question2: A DLP administrator needs to remove an agent its associated events from an Endpoint server.
Which Agent Task should the administrator perform to disable the agent's visibility in the Enforce
management console?

Question3: Which statement accurately describes where Optical Character Recognition (OCR) components must be
installed?

Question4: How should a DLP administrator exclude a custom endpoint application named "custom_app.exe" from
being monitoring by Application File Access Control?

Question5: What are two reasons an administrator should utilize a manual configuration to determine the endpoint
location? (Choose two.)

Question6: What is the Symantec recommended order for stopping Symantec DLP services on a Windows Enforce
server?

Question7: Where should an administrator set the debug levels for an Endpoint Agent?

Question8: A DLP administrator is attempting to add a new Network Discover detection server from the Enforce
management console. However, the only available options are Network Monitor and Endpoint servers.
What should the administrator do to make the Network Discover option available?

Question9: What should an incident responder select in the Enforce management console to remediate multiple
incidents simultaneously?

Question10: A software company wants to protect its source code, including new source code created between
scheduled indexing runs.
Which detection method should the company use to meet this requirement?

Question11: Which detection server is available from Symantec as a hardware appliance?

Question12: Refer to the exhibit.

What activity should occur during the baseline phase, according to the risk reduction model?

Question13: What detection technology supports partial contents matching?

Question14: Which two detection servers are available as virtual appliances? (Choose two.)

Question15: What detection server type requires a minimum of two physical network interface cards?

Question16: How should a DLP administrator change a policy so that it retains the original file when an endpoint
incident has detected a "cope to USB device" operation?

Question17: Which network Prevent action takes place when the network Incident list shows the message is
"Modified"?

Question18: Which service encrypts the message when using a Modify SMTP Message response rule?

Question19: Which two factors are common sources of data leakage where the main actor is well-meaning insider?
(Choose two.)

Question20: Which two components can perform a file system scan of a workstation? (Choose two.)

Question21: Under the "System Overview" in the Enforce management console, the status of a Network Monitor
detection server is shown as "Running Selected." The Network Monitor server's event logs indicate that
the packet capture and filereader processes are crashing.
What is a possible cause for the Network Monitor server being in this state?

Question22: A DLP administrator has enabled and successfully tested custom attribute lookups for incident data based
on the Active Directory LDAP plugin. The Chief Information Security Officer (CISO) has attempted to
generate a User Risk Summary report, but the report is empty. The DLP administrator confirms the Cisco's
role has the "User Reporting" privilege enabled, but User Risk reporting is still not working.
What is the probable reason that the User Risk Summary report is blank?

Question23: Which two detection technology options run on the DLP agent? (Choose two.)

Question24: How do Cloud Detection Service and the Enforce server communicate with each other?

Question25: Which two locations can Symantec DLP scan and perform Information Centric Encryption (ICE) actions
on? (Choose two.)

Question26: A DLP administrator created a new agent configuration for an Endpoint server. However, the endpoint
agents fail to receive the new configuration.
What is one possible reason that the agent fails to receive the new configuration?

Question27: Why would an administrator set the Similarity Threshold to s=zero when testing and tuning a Vector
Machine Learning (VML) profile?

Question28: A DLP administrator is checking the System Overview in the Enforce management console, and all of the
detection servers are showing as "unknown". The Vontu services are up and running on the detection
servers. Thousands of .IDC files are building up in the Incidents directory on the detection servers. There
is good network connectivity between the detection servers and the Enforce server when testing with the
telnet command.
How should the administrator bring the detection servers to a running state in the Enforce management
console?

Question29: A company needs to secure the content of all mergers and Acquisitions Agreements/ However, the
standard text included in all company literature needs to be excluded.
How should the company ensure that this standard text is excluded from detection?