Forcepoint Updated DSPM- Deploy-and-Administer Exam Questions and Answers by hiba

The correct answer is C . Forcepoint DSPM allows frequently used Enterprise Search filters to be saved as bookmarks, which is the appropriate method for Anna’s weekly workflow. The documented Enterprise Search capability states that the page lets users access recently used filters, save frequently used filters as bookmarks, customize column headings, and generate meaningful reports. It also supports advanced filtering through GetVisibility Query Language , where a GQL query narrows scanned-file results to a focused, manageable subset for analysis and action.

Operationally, Anna would go to Enterprise Search , enter the complex GQL filter in the search/query field, execute or validate the filter, and then select the star icon to bookmark it. Forcepoint support documentation confirms that administrators can save complex GQL queries by using the star icon, creating a GQL bookmark, and providing an appropriate description.

The other options are incorrect because DSPM does not use an Excel import workflow to load reusable GQL filters from Analytics or Enterprise Search. Administration is also not the documented location for saving Enterprise Search GQL bookmarks. References/topics: Enterprise Search, GQL Filtering, Bookmarked Filters, Exporting Data, Reusable Search Workflows .

Correct order: 3 → 2 → 6 → 5 → 4 → 1

Navigate to Administration > User Management .

Set realm to gv .

Select Users , then Add user .

Fill in the necessary user information.

Select Join Groups .

Select Administrators .

Forcepoint DSPM user administration for a standalone deployment is performed through the Keycloak-based user management workflow. The sequence begins by entering the DSPM administration area and opening User Management , which places the administrator in the identity-management context used to control DSPM UI access. The next critical step is selecting the gv realm. Forcepoint documentation specifically instructs administrators to select the gv realm after logging into Keycloak and warns against changing settings in the Master realm, because the DSPM application authorization model is tied to the gv realm rather than the default administrative realm.

After the correct realm is active, the administrator creates the account by selecting Users , choosing Add user , and entering required identity fields such as username, email, first name, and last name. Once the user object exists, access is completed through RBAC group membership. Forcepoint’s RBAC guidance recommends group-based role assignment: navigate to the user, open the Groups area, search/select the appropriate group, and click Join . Selecting Administrators grants the required administrative group membership and resulting DSPM access.

Path Detectors = Monitor storage locations of sensitive data

Content Detectors = Analyze data within files for sensitive data

Attribute Detectors = Identify meta-data within documents

Forcepoint DSPM separates detector logic into path, content, and attribute-based functions so classification can be driven by where data is stored, what the file contains, and what scan-derived attributes describe the file. Path Detectors evaluate file path information, including directory location, filename, and extension. Forcepoint describes them as identifying and classifying files based on directory location and file extensions, which aligns with monitoring storage locations where sensitive data resides.

Content Detectors inspect the actual contents of files. Forcepoint states that content detectors analyze file content and categorize based on keywords, phrases, positive and negative terms, or patterns, making them the correct match for analyzing data within files for sensitive data.

Attribute Detectors operate on scan-result attributes rather than raw text content alone. Forcepoint describes them as defining criteria for “critical” and “sensitive” based on attributes in scan results, including ML output or path/content detector hits. This maps most closely to identifying metadata or scan-derived characteristics within documents. References/topics: Detectors, Path Detectors, Content Detectors, Attribute Detectors, AI Mesh, Classification Model .

Select the Actions drop-down in the upper-right corner of the LDAP provider screen, then choose Sync all users or Sync changed users .

Manual synchronization is initiated from the LDAP provider configuration page inside Keycloak User Federation, not from the general DSPM dashboard or from the Users page. The correct UI location is the Actions menu at the upper-right of the LDAP provider screen. In the screenshot, this is the open drop-down containing options such as Sync all users , Sync changed users , Unlink users , and Remove imported . To force synchronization after a successful connection test, choose Sync all users for a full import or Sync changed users when only deltas are required.

Forcepoint DSPM uses Keycloak for Active Directory import. The official DSPM documentation states that AD users are added through Keycloak , with administrators selecting the gv realm, navigating to User Federation , and adding/configuring an LDAP provider. It also identifies synchronization settings such as Import users , Periodic full sync , and Periodic changed users sync as the mechanisms used to bring LDAP users into Keycloak and then into DSPM.

Therefore, the click target is the upper-right Actions drop-down on the LDAP provider page , specifically the sync command within that menu. References/topics: User Federation, LDAP Provider, Active Directory Import, Keycloak gv Realm, Synchronization Settings .