Pass the Symantec Data Loss Prevention 250-587 Questions and answers with CertsForce

Network Monitor can inspect only traffic that reaches its capture interfaces and that its protocol and content-analysis components can meaningfully process. When the traffic volume exceeds the supported inspection rate, the first optimization is to eliminate unnecessary traffic before adding infrastructure. Filtering encrypted, unsupported, irrelevant, or otherwise unreadable traffic prevents Network Monitor from consuming capture and processing capacity on sessions that cannot produce useful DLP inspection results. Options A and B incorrectly refer to Network Prevent servers rather than the overloaded Network Monitor detector. Installing additional network taps changes how traffic is copied to Network Monitor but does not inherently reduce the excessive volume being processed. Therefore, filtering unreadable traffic is the appropriate first performance-remediation step, making option C correct.

================

Optical Character Recognition is required when sensitive information exists as pixels rather than directly extractable text. A scanned document or image-based PDF may visibly contain names, account numbers, identification numbers, or other protected information, but normal detection rules cannot evaluate those characters until they have been converted into machine-readable text. OCR performs that conversion and passes the extracted text to the DLP detection process, where keywords, regular expressions, Data Identifiers, or other policy rules can inspect it. Keyword and regular-expression matching may operate after OCR processing, but neither technique performs the image-to-text conversion. Exact Data Matching also requires readable and normalized values before comparing content with an index. Therefore, Optical Character Recognition, option B, is the correct detection method.

================

A Mail Transfer Agent is an email-routing component responsible for transferring SMTP messages between mail systems. In a Symantec DLP Network Prevent for Email deployment, the MTA routes email to or through the prevention detector so that message headers, body content, and attachments can be inspected against DLP policies before delivery proceeds. Depending on the policy result and configured response rule, the email can be allowed, modified, redirected, quarantined, or blocked. An MTA is not responsible for browser security, general packet monitoring, or firewall administration. Although the option uses simplified wording, the MTA enables the capture and inspection workflow by directing SMTP traffic to the DLP detector. Therefore, option C most accurately represents the role of an MTA in Network Prevent for Email.

================