Symantec 250-438 Actual Free Exam Questions & Community Discussion

Exam Code/Number: 250-438
Exam Name/Title: Administration of Symantec Data Loss Prevention 15
Certification Provider: Symantec
Corresponding Certification: Symantec certification

Exam Questions: 70
Updated On: Jul 09, 2026

Question #1

Refer to the exhibit. Which type of Endpoint response rule is shown?

A. Endpoint Prevent: Block

B. Endpoint Prevent: Notify

C. Endpoint Prevent: User Cancel

D. Endpoint Prevent: User Notification

Discussion 0

Correct Answer: A Vote an answer

Question #2

Which network Prevent action takes place when the network Incident list shows the message is "Modified"?

A. Modify content from the body of an email

B. Add one or more SMTP headers to an email

C. Remove attachments from an email

D. Obfuscate text in the body of an email

Discussion 0

Correct Answer: B Vote an answer

Question #3

Which option correctly describes the two-tier installation type for Symantec DLP?

A. Install the Oracle database and a detection server in the same host, and install the Enforce server on a second host.

B. Install the Oracle database and Enforce server on the same host, and install detection servers on separate hosts.

C. Install the Oracle database on the host, and install the Enforce server and a detection server on a second host.

D. Install the Oracle database on a local physical host, and install the Enforce server and detection servers on virtual hosts in the Cloud.

Discussion 0

Correct Answer: B Vote an answer

Question #4

A DLP administrator needs to stop the PacketCapture process on a detection server. Upon inspection of the Server Detail page, the administrator discovers that all processes are missing from the display.
What are the processes missing from the Server Detail page display?

A. The Display Process Control setting on the Advanced Settings page is disabled.

B. The Advanced Process Control setting on the System Settings page is deselected.

C. The detection server Display Control Process option is disabled on the Server Detail page.

D. The detection server PacketCapture process is displayed on the Server Overview page.

Discussion 0

Correct Answer: B Vote an answer

Question #5

Which action is available for use in both Smart Response and Automated Response rules?

A. Modify SMTP message

B. Log to a Syslog Server

C. Limit incident data retention

D. Block email message

Discussion 0

Correct Answer: D Vote an answer

Question #6

Which two detection technology options ONLY run on a detection server? (Choose two.)

A. Indexed Document matching (IDM)

B. Exact data matching (EDM)

C. vector Machine Learning (VML)

D. Described Content Matching (DCM)

E. Form Recognition

Discussion 0

Correct Answer: A,B Vote an answer

Question #7

Which action should a DLP administrator take to secure communications between an on-premises Enforce server and detection servers hosted in the Cloud?

A. Use the "sslkeytool" utility to create certificates for the Enforce server and the hosted detection servers.

B. Use the built-in Symantec DLP certificate for both the Enforce server and the hosted detection servers.

C. Set up a Virtual Private Network (VPN) for the Enforce server and the hosted detection servers.

D. Use the built-in Symantec DLP certificate for the Enforce Server, and use the "sslkeytool" utility to create certificates for the detection servers.

Discussion 0

Correct Answer: D Vote an answer

Download Free Symantec 250-438 Demo

Simply submit your e-mail address below to get started with our free demo of your Symantec 250-438 exam.