Free Forcepoint DSPM- Deploy-and-Administer Practice Exam with Questions & Answers

The correct answer is C. Data Mapping . In Forcepoint DSPM, Security Posture Policies are used to define and govern critical business data assets, often referred to as crown-jewel data. Each policy represents a managed data asset associated with a department, owner, and query-based definition. The Data Mapping field is where the administrator enters or edits the GQL query that identifies which files or records belong to that data asset. Forcepoint’s documentation explicitly lists Asset Name , Department , Data Owner , and Data Mapping as required Security Posture Policy details, and defines Data Mapping as “a GQL query used to identify the data asset within the DSPM database.”

This distinction matters because Asset Name is only the business label, Department assigns responsibility to a business unit, and Data Owner identifies the person or group accountable for monitoring and compliance. The actual technical selection logic is contained in Data Mapping , where GQL can match data across sources such as SMB and SharePoint using query criteria like source and path. References/topics: Policy Center, Data Register, Security Posture Policies, Data Mapping, GQL, Data Asset Inventory .

The correct answers are Widgets and Panels . In Forcepoint DSPM Analytics, dashboards are organized as boards that present scan-derived security, compliance, and data-risk information. The primary structural components used to build those dashboards are panels and widgets. Forcepoint states that dashboards are “primarily constructed of panels and widgets,” and explains that each panel can contain one or more widgets. A panel acts as the container that organizes multiple visual components into a coherent dashboard layout, while a widget is the smaller information component that displays data from selected datasets such as files, trustees, connectors, or agents.

This structure matters because dashboards are not just static reports; they are configurable analytical workspaces. Widgets provide the actual data presentation, such as counters, charts, maps, text blocks, tables, incidents, dual data grouping, or multi-counter views. Forcepoint separately lists these as available widget types, each with its own customization options. Panels then provide the organizational layer that groups these widgets logically by use case, such as exposure, classification, incident review, user risk, or compliance posture. Toggle switches, menus, and status bars may appear in the interface, but they are not the dashboard-building elements. References/topics: Analytics, Components of a Dashboard, Widgets, Panels, Custom Dashboards .

Triggered Controls Orchestration rule events are found under Incidents . In Forcepoint DSPM, Controls Orchestration rules are designed to identify data that requires attention by evaluating selected datasets, such as files, trustees, or agent activities, against rule conditions. When a rule condition is met, the result is operationalized as an incident so the security or governance team can review the matched data and determine the appropriate response.

Forcepoint’s documentation states that each Controls Orchestration rule is “automatically added as a card in the Incidents tab,” and selecting an incident card takes the administrator back to the related rule. It also explains that the Incidents section provides a top-down view of all orchestration rules and available match results. The documented navigation path is Policy Center > Incidents .

The other options are not the correct location for triggered orchestration events. Default dashboards and overviews provide summary visibility, but they are not the dedicated rule-event review workspace. Analytics supports broader investigation and reporting, but Controls Orchestration match results are reviewed through the Incidents workflow. References/topics: Policy Center, Controls Orchestration, Incidents, Rule Match Results, Enterprise Search Review .

The correct selections are A, C, D, and E . A data classification and handling policy is a governance artifact that defines how data assets are categorized, owned, protected, reviewed, and aligned to legal or regulatory requirements. In Forcepoint DSPM, this sits within Policy Center and Compliance Hub , which are designed to support data classification, policy creation, security-control implementation, compliance, and risk reduction. Forcepoint states that Policy Center streamlines policy creation and prompts organizational representatives to provide information needed to build a governance framework aligned to organizational goals.

Specifying asset requirements maps to Data Mapping, where organizations define Data Asset Inventory fields and metadata such as retention period, business owner, regulatory scope, review status, and project name. Incorporating industry-specific regulations is required because departmental policy design must reflect obligations such as GDPR, HIPAA, and PCI DSS. Defining classification levels aligns to Taxonomy, where sensitivity levels such as Confidential, General Business, Public, and Highly Confidential are configured. Outlining roles and responsibilities aligns to assigning policy owners, department heads, representatives, and accountable stakeholders. Network traffic protocols are not a core step in creating a data classification and handling policy; they belong to network architecture or transport-control design, not data governance policy creation.

The correct answer is B . Forcepoint DSPM Controls Orchestration rules are built around query-driven rule logic. In the rule configuration workflow, administrators select a dataset such as Files , Trustees , or Agent Activities , then configure the rule condition using GQL syntax . This GQL condition defines which records match the rule and therefore which results appear as incidents when the rule is triggered. Forcepoint documentation states that Controls Orchestration rules identify data matching specific criteria and that the Condition field uses GQL syntax to filter the selected dataset.

When reviewing incidents, Forcepoint’s Incidents page provides a top-down view of orchestration rules and available match results. Selecting an incident card opens a results preview, and choosing View in the Page displays those matched files in Enterprise Search , where additional review and action options are available. Enterprise Search is specifically designed to narrow scanned-file results using GetVisibility Query Language , and Forcepoint notes that GQL filtering helps reduce the result set to a more manageable subset for analysis and action.

Timestamp, Risk type, and keyword filtering may be useful in other contexts, but the documented advanced review mechanism for these results is GQL-based filtering. References/topics: Controls Orchestration, Incidents, Enterprise Search, GQL Filtering, Rule Match Review .

The correct options are Yes/No, Select, and Text . In Forcepoint DSPM, Security Posture Policy Controls are configured under Policy Center > Compliance Hub > Data Mapping . These controls define the metadata fields that appear in the Data Asset Inventory , allowing data owners to describe and govern critical data assets using consistent business and compliance attributes. Forcepoint describes Data Mapping as the framework used to define fields available in the Data Asset Inventory so data owners can assign metadata tags to critical data. Examples include retention period, business owner, regulatory scope, review status, and project name.

The documented control types are Text , Yes/No , and Select . Text creates a free-form text field, useful for values such as project name or business context. Yes/No creates a binary drop-down, appropriate for simple governance questions such as whether a review is required. Select creates a predefined selection menu aligned with common data governance frameworks.

GQL query is not a Data Mapping control type; GQL is used elsewhere for search and Controls Orchestration rule conditions. Checkbox is also not listed as a supported Security Posture Policy Control option. References/topics: Compliance Hub, Data Mapping, Security Posture Policy Controls, Data Asset Inventory, Metadata Governance .

Click EDIT WIDGETS in the upper-right area of the dashboard.

Ella should click the EDIT WIDGETS button near the upper-right side of the dashboard, beside the EXPORT PDF button. This control opens the dashboard edit view, which exposes the controls required to modify dashboard content, including adding widgets and adding panels. In the screenshot, the correct click target is the green-outlined EDIT WIDGETS button above the dashboard panels.

Forcepoint documents dashboards as being primarily constructed from panels and widgets . A panel is the container that organizes one or more widgets, while widgets display selected datasets such as files, trustees, connectors, agents, or other DSPM analytics data. The Forcepoint documentation specifically states: “Edit Widgets: Click the Edit Widget button, to open the edit view.” It then lists Add widget and Add panel as functions available from that edit mode.

Therefore, Ella cannot add a panel by clicking the existing charts, the left navigation list, or the dashboard title. She must first enter edit mode through EDIT WIDGETS , then use the available Add panel option. References/topics: Analytics, Components of a Dashboard, Edit Widgets, Add Panel, Panels and Widgets .

The correct answer is A. Not contain . In Forcepoint DSPM, detector creation uses inclusion and exclusion logic to control what should trigger a detector match. The Contain field defines the positive match criteria: the keywords, phrases, regular expressions, extensions, or path terms that the detector should search for. The Not Contain field provides the negative condition: terms or criteria that should be ignored even when the broader detector logic would otherwise match.

Forcepoint’s DSPM documentation for Content Detectors states that if there are terms the detector should ignore, they are set in the Not Contain field. The same concept appears in Path Detectors , where administrators define the search method, populate Contain with triggering terms, and then use Not Contain to exclude terms from matching.

This matters operationally because detectors can otherwise generate excessive or misleading matches. For example, a detector looking for payroll-related content may include “salary” or “compensation” in Contain , while excluding harmless template, archive, or test terms in Not Contain . Not Add , Except , and Exclude are not the documented detector-configuration field names. References/topics: Administration > Detectors, Content Detectors, Path Detectors, Contain/Not Contain logic, AI Mesh detector contribution .

Correct order: 3 → 2 → 6 → 5 → 4 → 1

Navigate to Administration > User Management .

Set realm to gv .

Select Users , then Add user .

Fill in the necessary user information.

Select Join Groups .

Select Administrators .

Forcepoint DSPM user administration for a standalone deployment is performed through the Keycloak-based user management workflow. The sequence begins by entering the DSPM administration area and opening User Management , which places the administrator in the identity-management context used to control DSPM UI access. The next critical step is selecting the gv realm. Forcepoint documentation specifically instructs administrators to select the gv realm after logging into Keycloak and warns against changing settings in the Master realm, because the DSPM application authorization model is tied to the gv realm rather than the default administrative realm.

After the correct realm is active, the administrator creates the account by selecting Users , choosing Add user , and entering required identity fields such as username, email, first name, and last name. Once the user object exists, access is completed through RBAC group membership. Forcepoint’s RBAC guidance recommends group-based role assignment: navigate to the user, open the Groups area, search/select the appropriate group, and click Join . Selecting Administrators grants the required administrative group membership and resulting DSPM access.

Users/Administrator/Desk.../Technology Blueprint.csv

To view the file details for Technology Blueprint.CSV , select the diagonal expand/open-details icon on the far-left side of that file’s row in Enterprise Search . This icon appears before the row checkbox and before the file path. It is the row-level control used to open the detailed file view for the selected file.

Forcepoint DSPM’s Enterprise Search view presents discovered files in a tabular results format, with each row representing an individual scanned file and columns showing properties such as path, risk, classification, compliance, detector hits, attributes, keywords, and last classification date. Forcepoint documentation describes Enterprise Search as the location where each listed file has associated file details shown in columns and where administrators can refine displayed information through column configuration.

The checkbox is used for selecting the row for bulk or action-based operations, and the hamburger menu on the right provides additional row actions such as permissions or other menu-driven options. To inspect the file itself, the correct target is the left-side expand/details icon aligned with the Technology Blueprint.CSV entry. References/topics: Enterprise Search, File Details, Search Results Table, Row-Level Expand Details, File Classification Review .