Forcepoint DSPM- Deploy-and-Administer - Certified Forcepoint DSPM - Professional: Deploy and Administer Exam

The correct answer is D. To monitor the progress of ongoing data scans . The Scan Status dashboard is used to track scan execution and understand where a scan is in the discovery and classification lifecycle. Forcepoint’s scan analytics documentation describes scan status views that show the current discovery-stage status, last status update, discovered-file count, and detailed scan analytics for a selected data-source configuration. It also explains that the Scan Progress tab shows the selected scan configuration, discovery-stage status, last discovered file time, scan start time, scan number, classification status, and classification timing.

This makes the dashboard operationally useful for administrators who need to verify that scans are running, determine whether discovery or classification is still in progress, and identify whether scan activity has stalled or produced errors. It is not intended to display encrypted files, track department membership, or monitor network traffic. Department-level visibility is handled through Compliance Hub and Data Asset Inventory workflows, while network activity monitoring is outside the scope of the Scan Status dashboard. References/topics: Dashboard, Scan Status, Scan Analytics, Scan Progress, Discovery Status, Classification Status, Data Source Scanning .

The correct answer is D. To display the status of data scanning and any errors . In Forcepoint DSPM, the File Audit Log is tied to scan processing and file-level scan events. Forcepoint’s GQL reference defines the File Audit Log as “events associated with scanning of files,” and lists fields such as source , eventType , functionalityName , moduleName , createdAt , message , path , fileId , scanId , and configurationId . Those fields are designed to explain what happened to a file during the scan/classification process, including the relevant scan, module, event, and message detail.

This aligns with the scan analytics workflow. Forcepoint documents that when files are not classified, the interface can show the event indicating the classification failure, the file path, and the reason for the failure. It then allows the user to view the file audit log filtered by not-classified events, scan, and reason.

The other options describe different DSPM views. File access permissions are handled through access governance, discovered-file totals appear in scan analytics summaries, and last access information is a separate file activity or metadata concept. References/topics: Scan Analytics, File Audit Log, GQL File Audit Log Dataset, Scan Events, Classification Errors .

Click EDIT WIDGETS in the upper-right area of the dashboard.

Ella should click the EDIT WIDGETS button near the upper-right side of the dashboard, beside the EXPORT PDF button. This control opens the dashboard edit view, which exposes the controls required to modify dashboard content, including adding widgets and adding panels. In the screenshot, the correct click target is the green-outlined EDIT WIDGETS button above the dashboard panels.

Forcepoint documents dashboards as being primarily constructed from panels and widgets . A panel is the container that organizes one or more widgets, while widgets display selected datasets such as files, trustees, connectors, agents, or other DSPM analytics data. The Forcepoint documentation specifically states: “Edit Widgets: Click the Edit Widget button, to open the edit view.” It then lists Add widget and Add panel as functions available from that edit mode.

Therefore, Ella cannot add a panel by clicking the existing charts, the left navigation list, or the dashboard title. She must first enter edit mode through EDIT WIDGETS , then use the available Add panel option. References/topics: Analytics, Components of a Dashboard, Edit Widgets, Add Panel, Panels and Widgets .

The correct answers are Widgets and Panels . In Forcepoint DSPM Analytics, dashboards are organized as boards that present scan-derived security, compliance, and data-risk information. The primary structural components used to build those dashboards are panels and widgets. Forcepoint states that dashboards are “primarily constructed of panels and widgets,” and explains that each panel can contain one or more widgets. A panel acts as the container that organizes multiple visual components into a coherent dashboard layout, while a widget is the smaller information component that displays data from selected datasets such as files, trustees, connectors, or agents.

This structure matters because dashboards are not just static reports; they are configurable analytical workspaces. Widgets provide the actual data presentation, such as counters, charts, maps, text blocks, tables, incidents, dual data grouping, or multi-counter views. Forcepoint separately lists these as available widget types, each with its own customization options. Panels then provide the organizational layer that groups these widgets logically by use case, such as exposure, classification, incident review, user risk, or compliance posture. Toggle switches, menus, and status bars may appear in the interface, but they are not the dashboard-building elements. References/topics: Analytics, Components of a Dashboard, Widgets, Panels, Custom Dashboards .

Correct order: 3 → 2 → 6 → 5 → 4 → 1

Navigate to Administration > User Management .

Set realm to gv .

Select Users , then Add user .

Fill in the necessary user information.

Select Join Groups .

Select Administrators .

Forcepoint DSPM user administration for a standalone deployment is performed through the Keycloak-based user management workflow. The sequence begins by entering the DSPM administration area and opening User Management , which places the administrator in the identity-management context used to control DSPM UI access. The next critical step is selecting the gv realm. Forcepoint documentation specifically instructs administrators to select the gv realm after logging into Keycloak and warns against changing settings in the Master realm, because the DSPM application authorization model is tied to the gv realm rather than the default administrative realm.

After the correct realm is active, the administrator creates the account by selecting Users , choosing Add user , and entering required identity fields such as username, email, first name, and last name. Once the user object exists, access is completed through RBAC group membership. Forcepoint’s RBAC guidance recommends group-based role assignment: navigate to the user, open the Groups area, search/select the appropriate group, and click Join . Selecting Administrators grants the required administrative group membership and resulting DSPM access.

The correct selections are Rule-Based Automation, Incident Management, Webhook Notification System, and Workflow Configuration Tool . Forcepoint DSPM Controls Orchestration is built around rules that identify data requiring attention and can trigger notifications or automated responses. The official documentation describes Controls Orchestration as providing “automated work flows, rule-based detection, timely notifications, and efficient incident management,” which directly maps to these four options.

Rule-Based Automation is represented by custom rules that evaluate datasets such as files, trustees, or agent activities using GQL conditions. Workflow Configuration Tool is reflected in the rule-building process under Policy Center > Controls Orchestration , where administrators create rules, define ownership, select the asset, configure conditions, and enable the rule.

Webhook Notification System is valid because orchestration rules can send notifications outside Forcepoint DSPM, and webhook functionality sends HTTP requests to a configured callback endpoint when a defined condition is met. Incident Management is also core because each rule is automatically added as a card in the Incidents tab, linking detected conditions to operational review and response. Rule-Based Remediation is not the best answer here because remediation is an outcome of automated response workflows, not the named key feature in this option set. References/topics: Controls Orchestration, GQL Rules, Webhooks, Incidents, Policy Center .

A detector in Forcepoint DSPM is a rule-based classification component used during scanning to identify files whose content or path matches defined detection logic. The correct answer is B because detectors are designed to locate specific patterns, words, or expressions and then contribute to classification/tagging outcomes. Forcepoint describes Detector Groups in AI Mesh as components where “detectors assess both the file path and its contents using rule-based logic, such as regular expressions and keywords,” returning a match when the content fits the defined patterns.

This is distinct from AI classifiers, which infer sensitive-data meaning from broader semantic or machine-learning signals. Detectors are the more deterministic mechanism: they look for defined indicators such as a keyword, phrase, regular expression, or path element. Forcepoint release notes also describe detector functionality as allowing content or path search when creating a detector, including an example where adding the word Archive to a detector can tag files located in an Archive folder.

The other options confuse detectors with unrelated platform functions. Detectors do not create credential tags specifically, optimize network throughput, block files for speed, or increase storage capacity. References/topics: Detectors, Pattern Matching, AI Mesh, Classification Tags, Content and Path Search .

The correct answer is A. Encrypting data transfers . Detectors in Forcepoint DSPM are classification and discovery components, not transport-security controls. A detector is used to analyze file content, file paths, attributes, keywords, phrases, regular expressions, and positive or negative match terms so the platform can identify and categorize data during scans. Forcepoint describes Content Detectors as tools that “analyze file content to detect and categorize” based on keywords, phrases, or patterns, making them directly relevant to finding sensitive information.

Detectors also support compliance and breach-prevention outcomes because their findings contribute to the broader DSPM visibility model: identifying where sensitive data exists, how it is classified, and where risk-reduction actions may be needed. Forcepoint describes DSPM as providing visibility and risk remediation across cloud and on-premises environments, and notes that AI technology combined with Detectors and Compliance Hub helps organizations protect sensitive information and maintain regulatory requirements.

Encryption of data transfers, however, is handled by transport protocols, connector configuration, network security controls, or platform security architecture—not by detector logic. Detectors can help discover sensitive data that may require protection, but they do not encrypt traffic. References/topics: Detectors, Content Detectors, AI Mesh, Sensitive Data Discovery, Compliance Hub, Risk Remediation .

The correct answer is A. Not contain . In Forcepoint DSPM, detector creation uses inclusion and exclusion logic to control what should trigger a detector match. The Contain field defines the positive match criteria: the keywords, phrases, regular expressions, extensions, or path terms that the detector should search for. The Not Contain field provides the negative condition: terms or criteria that should be ignored even when the broader detector logic would otherwise match.

Forcepoint’s DSPM documentation for Content Detectors states that if there are terms the detector should ignore, they are set in the Not Contain field. The same concept appears in Path Detectors , where administrators define the search method, populate Contain with triggering terms, and then use Not Contain to exclude terms from matching.

This matters operationally because detectors can otherwise generate excessive or misleading matches. For example, a detector looking for payroll-related content may include “salary” or “compensation” in Contain , while excluding harmless template, archive, or test terms in Not Contain . Not Add , Except , and Exclude are not the documented detector-configuration field names. References/topics: Administration > Detectors, Content Detectors, Path Detectors, Contain/Not Contain logic, AI Mesh detector contribution .