Pass the Forcepoint Forcepoint DSPM DSPM- Deploy-and-Administer Questions and answers with CertsForce

The correct answer is B. Heatmap . Forcepoint DSPM dashboards are built from configurable widgets that present scan, access, classification, and risk data in different visual formats. The official Forcepoint DSPM widget list includes Counter , Chart , Map , Text , Table , Incidents , Dual Data Grouping , and Multi Counter . Heatmap is not listed as an available dashboard widget type.

The other answer choices are valid widget types. Counter widgets provide quick numerical summaries, such as counts of sensitive files, risky users, or matching records from selected datasets. Forcepoint describes Counter widgets as useful for at-a-glance metrics and supports aggregation functions such as count, sum, average, min, max, and median. Chart widgets visualize grouped data using supported chart formats, including horizontal bar, vertical bar, line, area, or pie charts. Text widgets are also part of the documented widget list and are used for static explanatory or contextual information on a board.

Therefore, Heatmap is the non-valid option. References/topics: Analytics, Dashboards, Widgets, Counter, Chart, Text, Dashboard Components .

Select the Actions drop-down in the upper-right corner of the LDAP provider screen, then choose Sync all users or Sync changed users .

Manual synchronization is initiated from the LDAP provider configuration page inside Keycloak User Federation, not from the general DSPM dashboard or from the Users page. The correct UI location is the Actions menu at the upper-right of the LDAP provider screen. In the screenshot, this is the open drop-down containing options such as Sync all users , Sync changed users , Unlink users , and Remove imported . To force synchronization after a successful connection test, choose Sync all users for a full import or Sync changed users when only deltas are required.

Forcepoint DSPM uses Keycloak for Active Directory import. The official DSPM documentation states that AD users are added through Keycloak , with administrators selecting the gv realm, navigating to User Federation , and adding/configuring an LDAP provider. It also identifies synchronization settings such as Import users , Periodic full sync , and Periodic changed users sync as the mechanisms used to bring LDAP users into Keycloak and then into DSPM.

Therefore, the click target is the upper-right Actions drop-down on the LDAP provider page , specifically the sync command within that menu. References/topics: User Federation, LDAP Provider, Active Directory Import, Keycloak gv Realm, Synchronization Settings .

The correct answer is A . Forcepoint DSPM pattern matching is designed to let administrators define and tune custom detection logic for organisation-specific sensitive data. The documented pattern-matching function identifies particular information in documents by using Regular Expressions , and Forcepoint notes that pattern matching uses Golang RegEx syntax, which is separate from Detector syntax.

When a new pattern is added under Administration > Pattern Matching , the configuration includes Pattern Name , Regular Expression , enablement state, hidden RegEx handling, and tag assignments for Classification , Compliance , and Distribution . Forcepoint states that the Regular Expression is “the sequence to be matched,” and that selected tags can override machine-learning model output during endpoint suggestions and file scans. This supports the principle that custom patterns can be adjusted so the RegEx better matches an organisation’s data formats, identifiers, project codes, or regulatory artifacts.

The other statements do not match the documented pattern workflow. Country assignment is not presented as a core custom-pattern field. Export/import of data patterns is not part of the stated pattern-matching configuration flow. Default or preconfigured patterns are provided as built-in detection content and should not be treated as administrator-editable RegEx templates. References/topics: Pattern Matching, Add New Pattern, RegEx, Classification Tags, Compliance Tags, Distribution Tags .

Triggered Controls Orchestration rule events are found under Incidents . In Forcepoint DSPM, Controls Orchestration rules are designed to identify data that requires attention by evaluating selected datasets, such as files, trustees, or agent activities, against rule conditions. When a rule condition is met, the result is operationalized as an incident so the security or governance team can review the matched data and determine the appropriate response.

Forcepoint’s documentation states that each Controls Orchestration rule is “automatically added as a card in the Incidents tab,” and selecting an incident card takes the administrator back to the related rule. It also explains that the Incidents section provides a top-down view of all orchestration rules and available match results. The documented navigation path is Policy Center > Incidents .

The other options are not the correct location for triggered orchestration events. Default dashboards and overviews provide summary visibility, but they are not the dedicated rule-event review workspace. Analytics supports broader investigation and reporting, but Controls Orchestration match results are reviewed through the Incidents workflow. References/topics: Policy Center, Controls Orchestration, Incidents, Rule Match Results, Enterprise Search Review .

1 → 3 → 4 → 2

The correct sequence is Select the Edit Widgets button , Open the Widget settings , Edit the GQL filter , and then Save the updated filter . In Forcepoint DSPM Analytics, a duplicated dashboard must first be placed into a widget-editable state before any individual widget configuration can be changed. Forcepoint describes dashboards as being built from panels and widgets , and identifies Edit Widgets as the control used to open the edit view for modifying widgets on a board. ( help.forcepoint.com )

After edit mode is active, the administrator opens the specific widget’s settings because the filter is scoped to that widget rather than the whole dashboard. The GQL filter is then edited to constrain the widget’s selected dataset, such as files, trustees, connectors, agents, database tables, or other analytics objects. This follows Forcepoint’s dashboard model, where widgets present information from selected datasets and have their own customization options. ( help.forcepoint.com ) The final action is saving the updated filter so the duplicated dashboard preserves the modified widget logic. References/topics: Analytics, Dashboard Components, Edit Widgets, Widget Settings, GQL Filters, Custom/Duplicated Dashboards .

The correct answer is B . In Forcepoint DSPM, content detectors analyze file contents using configured search logic such as keywords, phrases, positive and negative terms, or regular expressions. During detector creation, administrators can associate the detector with a detector group. Forcepoint states that when a detector group is selected, the detector becomes part of the AI Mesh and contributes to classification results. If the administrator does not want the detector to influence classification, a non-AI Mesh detector group should be selected instead.

This is important because detector grouping controls whether detector hits are merely informational or actively influence classification decisions. A payroll detector, for example, may search for terms such as salary, payslip, compensation, or payroll. If tied into the AI Mesh, those hits can help classify files as sensitive or confidential. The other options misrepresent detector behavior. Detectors do not automatically revoke permissions, convert keywords directly into taxonomy labels, or disappear from scan results when grouped. References/topics: Administration > Detectors, Content Detectors, Detector Groups, AI Mesh, Classification Results, Contain/Not Contain Logic .

The correct answer is A. Not contain . In Forcepoint DSPM, detector creation uses inclusion and exclusion logic to control what should trigger a detector match. The Contain field defines the positive match criteria: the keywords, phrases, regular expressions, extensions, or path terms that the detector should search for. The Not Contain field provides the negative condition: terms or criteria that should be ignored even when the broader detector logic would otherwise match.

Forcepoint’s DSPM documentation for Content Detectors states that if there are terms the detector should ignore, they are set in the Not Contain field. The same concept appears in Path Detectors , where administrators define the search method, populate Contain with triggering terms, and then use Not Contain to exclude terms from matching.

This matters operationally because detectors can otherwise generate excessive or misleading matches. For example, a detector looking for payroll-related content may include “salary” or “compensation” in Contain , while excluding harmless template, archive, or test terms in Not Contain . Not Add , Except , and Exclude are not the documented detector-configuration field names. References/topics: Administration > Detectors, Content Detectors, Path Detectors, Contain/Not Contain logic, AI Mesh detector contribution .

The correct answer is Keycloak . In Forcepoint DSPM standalone deployments, user authentication and user import workflows are handled through the embedded Keycloak administration console. The official Forcepoint DSPM documentation states that “AD Users are added to Forcepoint DSPM through Keycloak” and then describes the workflow for configuring Keycloak’s User Federation capability. The process begins by opening the Keycloak admin console, logging in as an administrator, confirming that the gv realm is selected, navigating to User Federation , and adding an LDAP provider for the Active Directory source.

The distractors map to adjacent but incorrect concepts. User Federation is not the third-party product; it is the Keycloak feature used to connect LDAP or Active Directory identity stores. Kubernetes provides container orchestration and is not responsible for directory import. Rancher is used in platform or cluster management contexts, not AD identity synchronization. Okta can function as an identity provider in many enterprise environments, but it is not the specific product identified in the DSPM AD import workflow. References/topics: User Management, Keycloak Administration, gv Realm, Active Directory Integration, LDAP Provider, User Federation .

The correct answer is D. To monitor the progress of ongoing data scans . The Scan Status dashboard is used to track scan execution and understand where a scan is in the discovery and classification lifecycle. Forcepoint’s scan analytics documentation describes scan status views that show the current discovery-stage status, last status update, discovered-file count, and detailed scan analytics for a selected data-source configuration. It also explains that the Scan Progress tab shows the selected scan configuration, discovery-stage status, last discovered file time, scan start time, scan number, classification status, and classification timing.

This makes the dashboard operationally useful for administrators who need to verify that scans are running, determine whether discovery or classification is still in progress, and identify whether scan activity has stalled or produced errors. It is not intended to display encrypted files, track department membership, or monitor network traffic. Department-level visibility is handled through Compliance Hub and Data Asset Inventory workflows, while network activity monitoring is outside the scope of the Scan Status dashboard. References/topics: Dashboard, Scan Status, Scan Analytics, Scan Progress, Discovery Status, Classification Status, Data Source Scanning .

The correct answer is C . Forcepoint DSPM allows frequently used Enterprise Search filters to be saved as bookmarks, which is the appropriate method for Anna’s weekly workflow. The documented Enterprise Search capability states that the page lets users access recently used filters, save frequently used filters as bookmarks, customize column headings, and generate meaningful reports. It also supports advanced filtering through GetVisibility Query Language , where a GQL query narrows scanned-file results to a focused, manageable subset for analysis and action.

Operationally, Anna would go to Enterprise Search , enter the complex GQL filter in the search/query field, execute or validate the filter, and then select the star icon to bookmark it. Forcepoint support documentation confirms that administrators can save complex GQL queries by using the star icon, creating a GQL bookmark, and providing an appropriate description.

The other options are incorrect because DSPM does not use an Excel import workflow to load reusable GQL filters from Analytics or Enterprise Search. Administration is also not the documented location for saving Enterprise Search GQL bookmarks. References/topics: Enterprise Search, GQL Filtering, Bookmarked Filters, Exporting Data, Reusable Search Workflows .