DSPM- Deploy-and-Administer Forcepoint Certified Forcepoint DSPM - Professional: Deploy and Administer Exam Free Practice Exam Questions (2026 Updated)

Administration > Taxonomy

Taxonomy tags are managed from the Administration menu, specifically under Administration > Taxonomy . In the screenshot, Adam should not select Policy Center ; the currently open menu shows Compliance Hub, Data Register, Controls Orchestration, and Incidents, but taxonomy management is not located there. The correct UI action is to open the Administration drop-down on the top navigation bar and select Taxonomy .

Forcepoint’s DSPM documentation states that the Taxonomy page displays predefined AI Mesh tags, which cannot be removed, and also allows administrators to add custom tags for pattern matching and detection rules. It further explains that taxonomy mapping can connect AI Mesh tags with data-source taxonomies so mapped tags can be written back as the organization’s own labels.

This location is important because taxonomy governs the classification language DSPM applies to scanned data. By updating taxonomy tags, Adam aligns DSPM classification output with the company’s internal handling policies, sensitivity labels, and compliance terminology. Forcepoint also notes that new taxonomy tags are created from the Taxonomy tab under the Administration section, and that applied tags are visible in the Data Asset Inventory. References/topics: Administration, Taxonomy, AI Mesh Tags, Classification Tags, Pattern Matching, Detection Rules .

The correct answer is A. Resolves Incident Reporting . Data Mapping in Forcepoint DSPM is a governance configuration capability within Policy Center > Compliance Hub , not an incident-resolution mechanism. Forcepoint defines Data Mapping, also referred to as Security Posture Policy Controls , as the building blocks for the Data Asset Inventory framework. It allows administrators to define the fields available in the Data Asset Inventory so data owners can assign metadata tags to critical data. Examples include retention period, business owner, regulatory scope, review status, and project name .

Those functions clearly support the valid benefits in the option set. Data Mapping improves data management by standardizing asset metadata. It enhances compliance by capturing regulatory scope and review-related fields. It also streamlines internal processes by giving departments a consistent structure for documenting ownership, retention, review status, and business context. Forcepoint also notes that only one data mapping configuration is available, so it should be designed generically enough for all departments, reinforcing its role as an enterprise-wide governance framework.

Incident reporting is handled separately through DSPM incident and controls-orchestration workflows. Data Mapping may enrich incident context, but it does not “resolve” incident reporting. References/topics: Compliance Hub, Data Mapping, Security Posture Policy Controls, Data Asset Inventory, Metadata Governance .

Correct order: 3 → 2 → 6 → 5 → 4 → 1

Navigate to Administration > User Management .

Set realm to gv .

Select Users , then Add user .

Fill in the necessary user information.

Select Join Groups .

Select Administrators .

Forcepoint DSPM user administration for a standalone deployment is performed through the Keycloak-based user management workflow. The sequence begins by entering the DSPM administration area and opening User Management , which places the administrator in the identity-management context used to control DSPM UI access. The next critical step is selecting the gv realm. Forcepoint documentation specifically instructs administrators to select the gv realm after logging into Keycloak and warns against changing settings in the Master realm, because the DSPM application authorization model is tied to the gv realm rather than the default administrative realm.

After the correct realm is active, the administrator creates the account by selecting Users , choosing Add user , and entering required identity fields such as username, email, first name, and last name. Once the user object exists, access is completed through RBAC group membership. Forcepoint’s RBAC guidance recommends group-based role assignment: navigate to the user, open the Groups area, search/select the appropriate group, and click Join . Selecting Administrators grants the required administrative group membership and resulting DSPM access.

The correct answer is B . Forcepoint DSPM Controls Orchestration rules are built around query-driven rule logic. In the rule configuration workflow, administrators select a dataset such as Files , Trustees , or Agent Activities , then configure the rule condition using GQL syntax . This GQL condition defines which records match the rule and therefore which results appear as incidents when the rule is triggered. Forcepoint documentation states that Controls Orchestration rules identify data matching specific criteria and that the Condition field uses GQL syntax to filter the selected dataset.

When reviewing incidents, Forcepoint’s Incidents page provides a top-down view of orchestration rules and available match results. Selecting an incident card opens a results preview, and choosing View in the Page displays those matched files in Enterprise Search , where additional review and action options are available. Enterprise Search is specifically designed to narrow scanned-file results using GetVisibility Query Language , and Forcepoint notes that GQL filtering helps reduce the result set to a more manageable subset for analysis and action.

Timestamp, Risk type, and keyword filtering may be useful in other contexts, but the documented advanced review mechanism for these results is GQL-based filtering. References/topics: Controls Orchestration, Incidents, Enterprise Search, GQL Filtering, Rule Match Review .

The correct answer is B . In Forcepoint DSPM, content detectors analyze file contents using configured search logic such as keywords, phrases, positive and negative terms, or regular expressions. During detector creation, administrators can associate the detector with a detector group. Forcepoint states that when a detector group is selected, the detector becomes part of the AI Mesh and contributes to classification results. If the administrator does not want the detector to influence classification, a non-AI Mesh detector group should be selected instead.

This is important because detector grouping controls whether detector hits are merely informational or actively influence classification decisions. A payroll detector, for example, may search for terms such as salary, payslip, compensation, or payroll. If tied into the AI Mesh, those hits can help classify files as sensitive or confidential. The other options misrepresent detector behavior. Detectors do not automatically revoke permissions, convert keywords directly into taxonomy labels, or disappear from scan results when grouped. References/topics: Administration > Detectors, Content Detectors, Detector Groups, AI Mesh, Classification Results, Contain/Not Contain Logic .

The correct answer is D. To monitor the progress of ongoing data scans . The Scan Status dashboard is used to track scan execution and understand where a scan is in the discovery and classification lifecycle. Forcepoint’s scan analytics documentation describes scan status views that show the current discovery-stage status, last status update, discovered-file count, and detailed scan analytics for a selected data-source configuration. It also explains that the Scan Progress tab shows the selected scan configuration, discovery-stage status, last discovered file time, scan start time, scan number, classification status, and classification timing.

This makes the dashboard operationally useful for administrators who need to verify that scans are running, determine whether discovery or classification is still in progress, and identify whether scan activity has stalled or produced errors. It is not intended to display encrypted files, track department membership, or monitor network traffic. Department-level visibility is handled through Compliance Hub and Data Asset Inventory workflows, while network activity monitoring is outside the scope of the Scan Status dashboard. References/topics: Dashboard, Scan Status, Scan Analytics, Scan Progress, Discovery Status, Classification Status, Data Source Scanning .

The correct answer is Keycloak . In Forcepoint DSPM standalone deployments, user authentication and user import workflows are handled through the embedded Keycloak administration console. The official Forcepoint DSPM documentation states that “AD Users are added to Forcepoint DSPM through Keycloak” and then describes the workflow for configuring Keycloak’s User Federation capability. The process begins by opening the Keycloak admin console, logging in as an administrator, confirming that the gv realm is selected, navigating to User Federation , and adding an LDAP provider for the Active Directory source.

The distractors map to adjacent but incorrect concepts. User Federation is not the third-party product; it is the Keycloak feature used to connect LDAP or Active Directory identity stores. Kubernetes provides container orchestration and is not responsible for directory import. Rancher is used in platform or cluster management contexts, not AD identity synchronization. Okta can function as an identity provider in many enterprise environments, but it is not the specific product identified in the DSPM AD import workflow. References/topics: User Management, Keycloak Administration, gv Realm, Active Directory Integration, LDAP Provider, User Federation .

The correct selections are Identifying high-risk users , Identifying ROT data , and Identifying critical data assets . Forcepoint DSPM Analytics includes pre-defined dashboards, or boards, that summarize scan findings into operational views for security, compliance, and data-governance teams. Forcepoint states that Analytics boards present scan-derived metrics such as overexposed files, sensitive data, and data at risk, helping teams make informed decisions about vulnerabilities, risks, and compliance issues.

The pre-defined board list directly supports the three correct options. High Risk Users identifies users with excessive permissions or abnormal access patterns, supporting insider-threat reduction and least-privilege enforcement. ROT Data identifies redundant, obsolete, or trivial data so teams can reduce clutter, unnecessary exposure, and policy risk. Key Data Overview highlights critical data assets, allowing teams to prioritize protection of the organization’s most valuable and sensitive information.

The other answers are not the best matches for dashboard simplification in this question. Database assets are handled through structured-data discovery and database-specific workflows, not the named dashboard use cases here. User credentials may be detected as sensitive content in scans, but identifying credentials is not listed as a primary pre-defined dashboard task. References/topics: Analytics, Pre-defined Boards, Data Classification, Data Hygiene, Data Risk, High Risk Users, ROT Data, Key Data Overview .

The correct answer is B. Heatmap . Forcepoint DSPM dashboards are built from configurable widgets that present scan, access, classification, and risk data in different visual formats. The official Forcepoint DSPM widget list includes Counter , Chart , Map , Text , Table , Incidents , Dual Data Grouping , and Multi Counter . Heatmap is not listed as an available dashboard widget type.

The other answer choices are valid widget types. Counter widgets provide quick numerical summaries, such as counts of sensitive files, risky users, or matching records from selected datasets. Forcepoint describes Counter widgets as useful for at-a-glance metrics and supports aggregation functions such as count, sum, average, min, max, and median. Chart widgets visualize grouped data using supported chart formats, including horizontal bar, vertical bar, line, area, or pie charts. Text widgets are also part of the documented widget list and are used for static explanatory or contextual information on a board.

Therefore, Heatmap is the non-valid option. References/topics: Analytics, Dashboards, Widgets, Counter, Chart, Text, Dashboard Components .

Forcepoint DSPM pattern matching is used to identify defined pieces of information inside scanned content by applying regular expressions. The documented function is discovery and classification: pattern matching identifies particular information in a document by using RegEx that attempts to match file content. This makes identifying personally identifiable information on SharePoint the correct use case. SharePoint is a supported Microsoft data source for scanning, and Forcepoint specifically documents SharePoint Online as a connector used to scan SharePoint accounts and apply classification tags to files containing sensitive data stored in SharePoint.

The key distinction is that pattern matching does not perform remediation actions such as redaction or encryption. Options B and D therefore overstate the capability: Forcepoint DSPM may discover and classify sensitive data that later informs controls, but the pattern itself is not a redaction or encryption engine. Option A is less precise in this context because the question is testing the canonical pattern-matching use case against scanned documents and repositories, while the strongest documented repository example among the choices is SharePoint. Pattern configuration can also assign classification, compliance, and distribution tags when a RegEx is detected, such as GDPR/PII tagging for identifiers. References/topics: Pattern Matching, RegEx, Compliance Tags, SharePoint Scanning, Sensitive Data Classification .

1 → 3 → 4 → 2

The correct sequence is Select the Edit Widgets button , Open the Widget settings , Edit the GQL filter , and then Save the updated filter . In Forcepoint DSPM Analytics, a duplicated dashboard must first be placed into a widget-editable state before any individual widget configuration can be changed. Forcepoint describes dashboards as being built from panels and widgets , and identifies Edit Widgets as the control used to open the edit view for modifying widgets on a board. ( help.forcepoint.com )

After edit mode is active, the administrator opens the specific widget’s settings because the filter is scoped to that widget rather than the whole dashboard. The GQL filter is then edited to constrain the widget’s selected dataset, such as files, trustees, connectors, agents, database tables, or other analytics objects. This follows Forcepoint’s dashboard model, where widgets present information from selected datasets and have their own customization options. ( help.forcepoint.com ) The final action is saving the updated filter so the duplicated dashboard preserves the modified widget logic. References/topics: Analytics, Dashboard Components, Edit Widgets, Widget Settings, GQL Filters, Custom/Duplicated Dashboards .