I85PREP
⌘ K
Forcepoint DLP Admin study materials
Forcepoint DLP Admin study resources

Forcepoint DLP Admin practice questions

One question at a time. Build your Forcepoint DLP Admin understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Forcepoint DLP

In Forcepoint DLP, which component is responsible for inspecting traffic and enforcing policies at the network gateway?

  1. The DLP Manager
  2. The DLP Protector (Network Protector) Correct answer.
  3. The SQL Server reporting database
  4. The endpoint agent installer

Explanation

The Network Protector sits inline or in monitor mode on the network path and performs content inspection and policy enforcement for traffic crossing it. The Manager is the central policy and configuration console, not the enforcement point for network traffic.

Question 2Forcepoint DLP

A DLP administrator wants to detect and block sensitive data leaving through web uploads. Which Forcepoint DLP component must be deployed on the endpoint to inspect and enforce on that traffic?

  1. The DLP Reporter
  2. The SMTP MTA relay
  3. The LDAP directory connector
  4. The Endpoint Protector (endpoint agent) Correct answer.

Explanation

The endpoint agent (Endpoint Protector) runs on the managed host and can inspect and enforce policy on local actions such as web uploads, clipboard, printing, and removable media. Network and mail relays only see traffic that traverses them, not local endpoint activity.

Question 3Forcepoint DLP

Which Forcepoint DLP object defines the actual content patterns, such as keywords, regular expressions, and document fingerprints, that a policy evaluates?

  1. The filter
  2. The action plan
  3. The policy
  4. The classifier Correct answer.

Explanation

Classifiers hold the detection logic: keyword lists, regular expressions, fingerprinting, and predefined dictionaries. Policies reference classifiers and combine them with actions and conditions.

Question 4Forcepoint DLP

In Forcepoint DLP policy structure, what is the role of an action plan?

  1. It defines the detection patterns for sensitive content.
  2. It synchronizes user identities from Active Directory.
  3. It schedules automatic software updates for the endpoint agent.
  4. It specifies the enforcement response, such as block, notify, or quarantine, when a rule matches. Correct answer.

Explanation

Action plans define the enforcement response applied when a policy rule matches, including blocking, user notification, incident routing, and remediation options. Detection logic lives in classifiers, not action plans.

Question 5Forcepoint DLP

Which statement best describes the function of document fingerprinting in Forcepoint DLP?

  1. It creates a signature of a source document so that portions of that document can be detected when they appear in outbound content. Correct answer.
  2. It hashes every file on the endpoint to detect malware.
  3. It encrypts documents before they leave the network.
  4. It converts documents to PDF for archival storage.

Explanation

Fingerprinting builds a signature from a source document and detects when a configured amount of its content appears elsewhere, even if the file is renamed or reformatted. It is a content-matching technique, not encryption or malware detection.

Question 6Forcepoint DLP

Which Forcepoint DLP feature allows an administrator to test a new policy's matches without actually blocking user activity?

  1. Endpoint lockdown
  2. Simulation (monitor-only) mode Correct answer.
  3. Quarantine mode
  4. Encryption enforcement

Explanation

Simulation or monitor-only mode records what a policy would have matched and what action it would have taken without enforcing a block. This lets administrators tune classifiers and thresholds before going live.

Question 7Forcepoint DLP

What is the primary purpose of the Forcepoint DLP incident management workflow?

  1. To route detected policy violations to reviewers for investigation, remediation, and closure Correct answer.
  2. To replicate the SQL database to a standby server
  3. To assign IP addresses to Protectors
  4. To compile the endpoint agent binaries

Explanation

Incident management routes detected violations to reviewers who investigate, apply remediation, and close the incident, providing an auditable record. It is a workflow layer on top of detection and enforcement.

Question 8Forcepoint DLP

Which predefined classifier category in Forcepoint DLP is designed to detect personal data such as national identification numbers and credit card numbers?

  1. Custom keyword classifiers only
  2. System or predefined classifiers for personal and financial data Correct answer.
  3. Application-control classifiers
  4. File-type classifiers

Explanation

Forcepoint DLP ships predefined (system) classifiers that recognize personal and financial data patterns such as credit card numbers and national IDs, which administrators can reuse in policies. Custom keywords are user-defined and file-type or application classifiers match by format or program, not data content.

Question 9Forcepoint DLP

An administrator needs a policy that triggers only when a user sends more than 50 credit card numbers in a single email. Which combination of policy elements achieves this?

  1. An endpoint lockdown action plan with no classifier
  2. A file-type classifier for PDF files only
  3. An LDAP group condition with no content classifier
  4. A credit card classifier with a threshold condition of greater than 50 matches and an email channel condition Correct answer.

Explanation

The policy needs a content classifier for credit card numbers plus a threshold condition that fires above 50 matches, scoped to the email channel. Threshold conditions are how Forcepoint DLP avoids alerting on incidental single matches.

Question 10Forcepoint DLP

A policy must block transfers to removable USB drives but only for users in the Finance department. Which configuration correctly scopes the policy?

  1. Apply the policy only to the SMTP channel
  2. Apply the policy to the Finance user group and include a removable-media channel condition Correct answer.
  3. Apply the policy to all users and rely on the endpoint agent to infer department membership
  4. Apply the policy to the Finance group without any channel condition

Explanation

Scoping requires both an identity condition (the Finance group) and a channel condition (removable media) so only the intended users and destination are affected. Forcepoint DLP resolves group membership through directory integration rather than inferring it at the endpoint.

Question 11Forcepoint DLP

Users report that legitimate business documents containing a common product name are being blocked. Which adjustment best reduces these false positives while preserving detection of true violations?

  1. Convert the policy to monitor mode permanently
  2. Remove the endpoint agent from all users
  3. Disable the classifier entirely
  4. Add the product name to a whitelist exception or raise the classifier threshold Correct answer.

Explanation

Whitelisting known-benign terms or raising thresholds reduces incidental matches without eliminating detection. Disabling detection or permanently monitoring removes protection and is not a targeted fix.

Question 12Forcepoint DLP

What is the function of the Forcepoint DLP Protector in a network deployment?

  1. It inspects network traffic against policies and can block or monitor based on configuration Correct answer.
  2. It provides the web-based management console
  3. It stores the incident database
  4. It synchronizes user accounts from Active Directory

Explanation

The Network Protector performs inline inspection of traffic against deployed policies and enforces the configured action. Storage, management UI, and identity synchronization are handled by other components.

Question 13Forcepoint DLP

An administrator wants to ensure that encrypted archives cannot bypass content inspection. What is the most appropriate Forcepoint DLP capability to enable?

  1. A file-type classifier that permits all ZIP files
  2. An action plan that only logs incidents
  3. A directory connector refresh schedule
  4. Encrypted content or password-protected file handling that flags or blocks uninspectable archives Correct answer.

Explanation

Forcepoint DLP can be configured to detect encrypted or password-protected archives it cannot inspect and to treat them according to policy, such as blocking or flagging. Simply permitting ZIP files or only logging leaves an inspection gap.

Question 14Forcepoint DLP

Which statement accurately describes how Forcepoint DLP uses directory integration?

  1. It encrypts endpoint hard drives
  2. It imports users and groups so policies and incidents can be scoped and attributed to identities Correct answer.
  3. It replaces the need for classifiers in policies
  4. It provides the network firewall rules for the Protector

Explanation

Directory integration imports user and group objects so policies can target specific populations and incidents can be attributed to real identities. It does not replace classifiers or provide firewall or disk-encryption functions.

Question 15Forcepoint DLP

A DLP administrator needs incidents from the endpoint to appear in the central management console. What must be in place?

  1. The endpoint agent must be registered with and able to communicate to the DLP Manager Correct answer.
  2. The endpoint must be joined to the same subnet as the SQL server
  3. The user must have local administrator rights
  4. The Protector must be placed in monitor mode

Explanation

Endpoint incidents reach the central console only when the agent is registered with the Manager and can communicate with it. Subnet placement, Protector mode, and local admin rights do not determine incident reporting.

Question 16Forcepoint DLP

Which action plan option best supports a graduated response where users are first warned and repeated violations are then blocked?

  1. An action plan that deletes the file silently
  2. A user-notification action combined with a blocking action governed by incident count or repeat-offense conditions Correct answer.
  3. A monitor-only action with no escalation
  4. A single permanent block with no notification

Explanation

Graduated enforcement combines user notification with blocking, escalating based on repeat-offense or incident-count conditions. A permanent block with no notification or a monitor-only plan does not implement graduated response.

Question 17Forcepoint DLP

What does the Forcepoint DLP risk ranking or user risk score represent?

  1. An aggregated measure of a user's policy violations used to prioritize review and apply stricter controls Correct answer.
  2. The size of the incident database
  3. The number of agents installed on a host
  4. The CPU load on the Protector

Explanation

Risk ranking aggregates a user's violation history into a score that helps prioritize investigations and can drive stricter policy for higher-risk users. It is not a system performance or inventory metric.

Question 18Forcepoint DLP

An organization must prove that outbound emails containing source code are blocked and that reviewers acted on each incident. Which two capabilities together satisfy this?

  1. Content classifiers with blocking action plans, plus incident workflow with audit records Correct answer.
  2. Protector monitor mode alone
  3. Endpoint lockdown alone
  4. Directory synchronization alone

Explanation

Detection and blocking come from classifiers plus enforcing action plans, while the incident workflow provides the reviewer actions and audit trail needed for proof. Neither capability alone delivers both prevention and documented response.

Question 19Forcepoint DLP

Which factor most directly determines whether a fingerprinting classifier produces excessive false positives?

  1. The amount and uniqueness of the source document content used to build the fingerprint Correct answer.
  2. The version of the SQL Server
  3. The number of Protectors in the network
  4. The color depth of the endpoint display

Explanation

Fingerprint quality depends on how much distinctive source content is captured; short or generic documents yield weak signatures and more false matches. Display settings, Protector count, and database version do not affect fingerprint accuracy.

Question 20Forcepoint DLP

A policy uses a keyword classifier with a threshold of three matches. A message contains the keyword twice. What is the expected result?

  1. The policy rule triggers and blocks the message
  2. The policy rule triggers only on the SMTP channel
  3. The policy rule does not trigger because the threshold is not met Correct answer.
  4. The policy rule triggers only if the user is in Finance

Explanation

A threshold condition requires the configured number of matches before the rule fires; two matches fall below a threshold of three. User group and channel conditions are separate scoping elements and do not override the threshold.

Question 21Forcepoint DLP

An administrator observes that network incidents are recorded but nothing is blocked. Which configuration is the most likely cause?

  1. The LDAP connector is offline
  2. The SQL database is full
  3. The endpoint agent is uninstalled
  4. The Protector or policy is set to monitor (simulation) mode rather than enforcing mode Correct answer.

Explanation

Monitor or simulation mode records matches without blocking, which exactly matches the symptom of incidents appearing but no enforcement. An uninstalled endpoint agent, an offline directory connector, or a full database would produce different symptoms.

Question 22Forcepoint DLP

Two policies match the same outbound email: one applies a notify action and the other applies a block action. How should the administrator expect Forcepoint DLP to resolve the conflict?

  1. Only the first policy in alphabetical order applies
  2. Both actions are ignored and the email is delivered
  3. The user is prompted to choose which policy applies
  4. The more restrictive enforcement action typically prevails according to policy precedence and the configured action behavior Correct answer.

Explanation

When multiple policies match, Forcepoint DLP applies its precedence and action-combination logic, generally honoring the more restrictive enforcement so a block is not weakened by a notify. Alphabetical ordering, ignoring both, and user choice are not how the engine resolves conflicts.

Question 23Forcepoint DLP

A fingerprinting policy is missing violations when users send only a small excerpt of a protected document. Which tuning change is most appropriate?

  1. Restrict the policy to the Finance group only
  2. Lower the fingerprint match threshold so smaller excerpts are detected, while monitoring false positives Correct answer.
  3. Increase the threshold to reduce processing load
  4. Disable fingerprinting and rely on file-type classifiers

Explanation

Lowering the fingerprint threshold allows smaller excerpts to match, at the cost of more false positives that should be monitored. Disabling fingerprinting or raising the threshold would worsen detection, and group scoping does not address excerpt size.

Question 24Forcepoint DLP

An administrator must ensure that sensitive data copied to the clipboard is detected on managed endpoints. Which deployment and policy combination is required?

  1. The SMTP relay with a clipboard classifier
  2. The endpoint agent installed on managed hosts with a policy covering the clipboard channel Correct answer.
  3. The directory connector with a clipboard action plan
  4. The Network Protector placed inline with a clipboard channel condition

Explanation

Clipboard activity is local to the endpoint, so detection requires the endpoint agent plus a policy that includes the clipboard channel. Network, mail, and directory components do not observe local clipboard operations.

Question 25Forcepoint DLP

A DLP team wants to reduce alert fatigue without weakening enforcement of truly sensitive content. Which approach best reflects sound tuning practice?

  1. Remove all thresholds so every match alerts
  2. Review incident data, refine classifiers and thresholds, add targeted exceptions, and keep enforcing actions for high-confidence detections Correct answer.
  3. Disable incident routing to reviewers
  4. Set every policy to monitor mode

Explanation

Sound tuning uses incident data to refine classifiers, thresholds, and exceptions while preserving enforcement for high-confidence detections. Blanket monitoring, removing thresholds, or disabling routing either weakens enforcement or increases noise.

Question 26Forcepoint DLP

Which component of a Forcepoint DLP deployment is responsible for applying policy to traffic observed on the network and reporting incidents to the management server?

  1. The DLP Fingerprint Repository
  2. The DLP Manager
  3. The DLP Protector Correct answer.
  4. The DLP Endpoint Agent

Explanation

The Protector is the enforcement point that inspects network traffic against deployed policies and forwards incident data to the management server. The Manager is the administrative and reporting console rather than the inspection engine. Endpoint agents handle host-based enforcement, not network traffic.

Question 27Forcepoint DLP

In Forcepoint DLP, which object is used to group users, groups, and domains so that policies can be targeted at a defined population?

  1. An action plan
  2. A policy group
  3. A classifier set
  4. A user group Correct answer.

Explanation

User groups are the directory-based containers that policies reference when scoping who a rule applies to. Action plans define what happens on a match rather than who is covered. Classifier sets define what content is detected, not the population.

Question 28Forcepoint DLP

Which Forcepoint DLP resource type is built from a set of documents so that the system can detect when similar content leaves the organization?

  1. A dictionary classifier
  2. A document fingerprint Correct answer.
  3. A file-type filter
  4. A pattern classifier

Explanation

Document fingerprinting derives signatures from source files so that later transfers of that content, or close variants, can be detected. Dictionaries match listed terms and patterns match regular expressions, neither of which captures whole-document similarity. File-type filters only look at format, not content.

Question 29Forcepoint DLP

What is the purpose of the Forcepoint DLP incident quarantine area?

  1. To archive all email for regulatory retention regardless of policy
  2. To cache classifier updates before they reach endpoints
  3. To hold outbound messages until a recipient confirms delivery
  4. To store copies of matched content so reviewers can examine what triggered a violation Correct answer.

Explanation

Quarantine retains the offending content, or a reference to it, so that incident reviewers can inspect exactly what matched during investigation. It is not a mail delivery queue, a blanket email archive, or a distribution mechanism for classifier updates.

Question 30Forcepoint DLP

Which Forcepoint DLP role is assigned to a person who should review incidents and take action on them but should not modify policies?

  1. Super administrator
  2. Auditor
  3. Policy administrator
  4. Incident manager Correct answer.

Explanation

The incident manager role is scoped to reviewing and acting on incidents without granting policy authoring rights. Policy administrators and super administrators can change policy configuration, which exceeds the required scope. Auditors have read-oriented visibility rather than incident remediation duties.

Question 31Forcepoint DLP

What does the Forcepoint DLP discovery (data-at-rest) function primarily accomplish?

  1. It blocks real-time transfers at the network gateway
  2. It scans stored repositories to locate sensitive data that policies would flag in transit Correct answer.
  3. It replaces endpoint agents on managed laptops
  4. It encrypts files on file servers automatically

Explanation

Discovery crawls storage locations such as file shares and repositories to find content that matches classifiers, revealing where sensitive data rests. It complements rather than replaces real-time enforcement. It does not encrypt files or substitute for endpoint agents.

Question 32Forcepoint DLP

In Forcepoint DLP, which construct defines the sequence of responses, such as notify, encrypt, or block, that apply when a policy is violated?

  1. A classifier threshold
  2. A policy schedule
  3. A directory connection
  4. An action plan Correct answer.

Explanation

An action plan bundles the responses that a policy invokes on a match, including user notification, encryption, and blocking. Thresholds tune detection sensitivity, schedules control when rules are active, and directory connections supply identity data.

Question 33Forcepoint DLP

Which data type in Forcepoint DLP would an administrator select to detect content that matches a list of internal project codenames?

  1. A document fingerprint
  2. A file-type classifier
  3. A custom dictionary Correct answer.
  4. A predefined personal data classifier

Explanation

A custom dictionary is the appropriate resource for an explicit list of organization-specific terms such as codenames. Predefined classifiers target regulated personal data categories, file-type classifiers examine format, and fingerprinting targets whole-document similarity.

Question 34Forcepoint DLP

An administrator wants a policy to apply only during business hours on weekdays. Which configuration element should be used?

  1. A user group
  2. An action plan
  3. A classifier threshold
  4. A policy schedule Correct answer.

Explanation

Schedules define the time windows during which a policy is active, which is exactly what restricting enforcement to business hours requires. Action plans define responses, user groups define the population, and thresholds define detection sensitivity.

Question 35Forcepoint DLP

A policy must detect when users upload files containing customer records to any web destination. Which Forcepoint DLP channel configuration is required?

  1. Enable only removable media inspection
  2. Enable inspection of HTTPS uploads on the Protector Correct answer.
  3. Enable only endpoint print monitoring
  4. Enable only SMTP inspection

Explanation

Web uploads travel over HTTPS, so the Protector must be able to inspect that channel and decrypt where necessary for content to be evaluated. SMTP covers email, removable media covers USB devices, and print monitoring covers endpoint printing, none of which address web uploads.

Question 36Forcepoint DLP

An administrator needs to give reviewers visibility into incidents only for the Finance user group. Which configuration achieves this?

  1. Disable incident reporting for all other groups
  2. Create a new Protector dedicated to Finance traffic
  3. Assign the reviewers the super administrator role
  4. Assign the reviewers a role with an incident scope limited to the Finance group Correct answer.

Explanation

Role-based access with an incident scope limited to a user group restricts reviewers to the incidents they should see. Granting super administrator rights would expose all incidents, disabling reporting would remove data others need, and a dedicated Protector does not by itself scope incident visibility.

Question 37Forcepoint DLP

A fingerprinting policy must detect protected documents even after users reformat them slightly. Which fingerprinting setting should the administrator review?

  1. The SMTP greeting timeout
  2. The incident retention period
  3. The similarity or partial-match threshold Correct answer.
  4. The endpoint agent heartbeat interval

Explanation

Fingerprint classifiers use similarity thresholds that determine how closely content must resemble the source to be flagged, which governs tolerance to reformatting. Timeouts, heartbeats, and retention periods affect connectivity and data lifecycle rather than content matching.

Question 38Forcepoint DLP

An administrator wants to validate that a newly authored policy would match real traffic before enabling its blocking response. Which approach is most appropriate?

  1. Deploy the policy with blocking enabled and monitor user complaints
  2. Deploy the policy with a response that only logs or notifies, then review the resulting incidents Correct answer.
  3. Disable all other policies so only the new one is active
  4. Run discovery scans against file servers instead

Explanation

Deploying with a non-blocking response lets the team observe real matches and confirm accuracy before enforcement begins. Blocking immediately risks disrupting users, disabling other policies distorts results, and discovery scans stored content rather than live traffic.

Question 39Forcepoint DLP

A policy references a user group from the corporate directory, but incidents show the user as unknown. Which area should the administrator check first?

  1. The incident retention period
  2. The SMTP relay configuration
  3. The endpoint agent version
  4. The directory connection and synchronization status Correct answer.

Explanation

Unresolved identities usually indicate that the directory connection is failing or synchronization is stale, so user and group mappings are missing. Mail relay settings, agent versions, and retention periods do not determine whether directory identities resolve.

Question 40Forcepoint DLP

An administrator wants to detect source code leaving the organization without maintaining a list of every function name. Which classifier approach is most suitable?

  1. A predefined personal data classifier
  2. A dictionary of common programming keywords
  3. A file-type classifier for text files
  4. A fingerprint of the organization's code repositories Correct answer.

Explanation

Fingerprinting the code repositories captures the substance of proprietary code so that excerpts and variants can be detected without enumerating identifiers. Keyword dictionaries are brittle and miss novel code, file-type classifiers ignore content, and personal data classifiers target regulated identifiers.

Question 41Forcepoint DLP

An administrator must confirm which users received a blocked file and what action the system took. Which Forcepoint DLP capability provides this?

  1. The policy schedule configuration
  2. The classifier threshold settings
  3. Incident reporting with the associated action details Correct answer.
  4. The directory synchronization log

Explanation

Incident records capture the user, the matched content, and the action taken, which together answer who was affected and what happened. Schedules, thresholds, and directory logs describe configuration rather than enforcement outcomes.

Question 42Forcepoint DLP

A policy must apply to traffic leaving through a specific network segment while other segments remain uninspected. Which Forcepoint DLP configuration supports this?

  1. Lower the classifier threshold globally
  2. Extend the incident retention period
  3. Create a new user group for the segment
  4. Deploy a Protector on that segment and associate the policy with it Correct answer.

Explanation

Protectors are deployed at inspection points, and policies can be associated with specific Protectors so enforcement is limited to the traffic they see. User groups scope identity, thresholds tune detection, and retention affects record keeping, none of which restrict inspection to a segment.

Question 43Forcepoint DLP

An administrator wants to reduce the volume of low-value incidents from a dictionary classifier that matches common business terms. Which adjustment is most appropriate?

  1. Increase the incident retention period
  2. Raise the match threshold and refine the dictionary terms Correct answer.
  3. Remove the policy from all Protectors
  4. Disable incident reporting for the classifier

Explanation

Raising the threshold requires more matches before an incident is generated, and refining terms removes ambiguous entries, together reducing noise while preserving detection. Disabling reporting or removing the policy eliminates detection, and retention changes do not affect incident volume.

Question 44Forcepoint DLP

A policy must notify the sender and also record the incident when sensitive content is detected, without preventing delivery. Which action plan configuration achieves this?

  1. Block the transfer and log the incident
  2. Delete the message silently
  3. Notify the user and log the incident without a block action Correct answer.
  4. Encrypt the content and block the transfer

Explanation

Combining a user notification with incident logging satisfies both requirements while leaving delivery unaffected. Blocking or encrypting with blocking prevents delivery, and silent deletion removes the message without informing anyone.

Question 45Forcepoint DLP

An administrator needs to test how a policy behaves for a specific user without affecting production traffic. Which approach is most appropriate?

  1. Use the policy simulation capability against sample content for that user Correct answer.
  2. Disable the directory connection temporarily
  3. Deploy the policy with blocking for all users
  4. Change the incident retention period to one day

Explanation

Simulation evaluates policy logic against sample content and a chosen identity without enforcing on live traffic. Deploying blocking affects production users, disabling directory integration breaks identity resolution, and retention changes do not test policy behavior.

Question 46Forcepoint DLP

Two classifiers in the same policy are combined with an AND condition. A message matches the dictionary classifier but not the fingerprint classifier. What is the outcome?

  1. The policy triggers only if the user is in a monitored group
  2. The policy triggers because one condition is satisfied
  3. The policy does not trigger because both conditions must be satisfied Correct answer.
  4. The policy triggers and escalates to the highest severity action

Explanation

An AND condition requires every referenced classifier to match before the policy fires, so a single match is insufficient. OR logic would trigger on one match, and user group membership or action severity does not override the logical condition.

Question 47Forcepoint DLP

An administrator observes that incidents are generated for email but not for web uploads of the same content. Which cause is most likely?

  1. The web channel is not enabled for inspection on the Protector handling that traffic Correct answer.
  2. The incident retention period is too short
  3. The directory connection is synchronized too frequently
  4. The classifier threshold is too low for email

Explanation

If email produces incidents while web uploads do not, the most likely explanation is that the web channel is not being inspected at the relevant Protector. Thresholds, retention, and synchronization frequency would affect both channels rather than selectively suppressing web incidents.

Question 48Forcepoint DLP

A fingerprinting classifier produces excessive false positives against marketing brochures that reuse boilerplate text from protected documents. Which tuning approach is most appropriate?

  1. Increase the required similarity level and exclude boilerplate sections from the source set Correct answer.
  2. Lower the similarity threshold to capture more variants
  3. Reduce the number of Protectors inspecting the channel
  4. Add the brochures to the protected source set

Explanation

Raising the similarity requirement means only closer matches trigger, and removing boilerplate from the source set stops shared phrasing from driving matches. Lowering the threshold increases false positives, adding brochures expands the protected set incorrectly, and reducing Protectors weakens coverage.

Question 49Forcepoint DLP

An organization needs to demonstrate that a specific policy was enforced and that reviewers closed each resulting incident. Which combination of Forcepoint DLP capabilities supports this?

  1. Protector deployment diagrams plus network diagrams
  2. Directory synchronization logs plus endpoint heartbeats
  3. Incident records with action details plus reviewer workflow status and audit history Correct answer.
  4. Policy schedules plus classifier thresholds

Explanation

Incident records show what action was enforced, while workflow status and audit history show that reviewers handled each case, together providing the evidence trail. Schedules, thresholds, synchronization logs, and diagrams describe configuration rather than enforcement and review outcomes.

Question 50Forcepoint DLP

An administrator wants endpoint incidents to include the local user identity and the file path involved. Which deployment element must be present and correctly configured?

  1. The endpoint agent registered with the management server and reporting to it Correct answer.
  2. A new dictionary classifier for file paths
  3. A discovery scan of the user's file share
  4. An additional Protector on the user's subnet

Explanation

Endpoint incidents originate from the agent, which must be registered with the management server and reporting so that local identity and path details reach the console. Protectors inspect network traffic, discovery scans stored repositories, and classifiers detect content rather than supply endpoint metadata.