The correct selections are Rule-Based Automation, Incident Management, Webhook Notification System, and Workflow Configuration Tool . Forcepoint DSPM Controls Orchestration is built around rules that identify data requiring attention and can trigger notifications or automated responses. The official documentation describes Controls Orchestration as providing “automated work flows, rule-based detection, timely notifications, and efficient incident management,” which directly maps to these four options.

Rule-Based Automation is represented by custom rules that evaluate datasets such as files, trustees, or agent activities using GQL conditions. Workflow Configuration Tool is reflected in the rule-building process under Policy Center > Controls Orchestration , where administrators create rules, define ownership, select the asset, configure conditions, and enable the rule.

Webhook Notification System is valid because orchestration rules can send notifications outside Forcepoint DSPM, and webhook functionality sends HTTP requests to a configured callback endpoint when a defined condition is met. Incident Management is also core because each rule is automatically added as a card in the Incidents tab, linking detected conditions to operational review and response. Rule-Based Remediation is not the best answer here because remediation is an outcome of automated response workflows, not the named key feature in this option set. References/topics: Controls Orchestration, GQL Rules, Webhooks, Incidents, Policy Center .

The correct answer is C . Forcepoint DSPM allows frequently used Enterprise Search filters to be saved as bookmarks, which is the appropriate method for Anna’s weekly workflow. The documented Enterprise Search capability states that the page lets users access recently used filters, save frequently used filters as bookmarks, customize column headings, and generate meaningful reports. It also supports advanced filtering through GetVisibility Query Language , where a GQL query narrows scanned-file results to a focused, manageable subset for analysis and action.

Operationally, Anna would go to Enterprise Search , enter the complex GQL filter in the search/query field, execute or validate the filter, and then select the star icon to bookmark it. Forcepoint support documentation confirms that administrators can save complex GQL queries by using the star icon, creating a GQL bookmark, and providing an appropriate description.

The other options are incorrect because DSPM does not use an Excel import workflow to load reusable GQL filters from Analytics or Enterprise Search. Administration is also not the documented location for saving Enterprise Search GQL bookmarks. References/topics: Enterprise Search, GQL Filtering, Bookmarked Filters, Exporting Data, Reusable Search Workflows .

The correct answers are B and C . Forcepoint DSPM pattern matching is used to identify specific information inside documents during scans. Forcepoint defines pattern matching as functionality that identifies “particular pieces of information in a document” by using regular expressions that match file content. A credit-card-like numeric string is a direct fit because it represents structured sensitive data that can be detected using a predictable format and then associated with compliance obligations such as PCI-related handling.

Option C is also valid because Forcepoint DSPM supports custom identification of sensitive business data, including intellectual property and trade secrets. A regular expression can be configured to detect proprietary product identifiers, engineering codes, project names, or other technical markers associated with confidential product development. Forcepoint’s pattern terminology defines a Pattern as the RegEx plus the rules associated with detection, and allows classification, compliance, and distribution tags to be applied when the pattern is detected.

Options A , D , and E describe general regex use cases outside Forcepoint DSPM pattern matching. They focus on scripting, log parsing, and web-form validation rather than data discovery, classification, and governance. References/topics: Pattern Matching, RegEx, Classification Tags, Compliance Tags, Sensitive Data Discovery .

Correct order: 3 → 2 → 6 → 5 → 4 → 1

Navigate to Administration > User Management .

Set realm to gv .

Select Users , then Add user .

Fill in the necessary user information.

Select Join Groups .

Select Administrators .

Forcepoint DSPM user administration for a standalone deployment is performed through the Keycloak-based user management workflow. The sequence begins by entering the DSPM administration area and opening User Management , which places the administrator in the identity-management context used to control DSPM UI access. The next critical step is selecting the gv realm. Forcepoint documentation specifically instructs administrators to select the gv realm after logging into Keycloak and warns against changing settings in the Master realm, because the DSPM application authorization model is tied to the gv realm rather than the default administrative realm.

After the correct realm is active, the administrator creates the account by selecting Users , choosing Add user , and entering required identity fields such as username, email, first name, and last name. Once the user object exists, access is completed through RBAC group membership. Forcepoint’s RBAC guidance recommends group-based role assignment: navigate to the user, open the Groups area, search/select the appropriate group, and click Join . Selecting Administrators grants the required administrative group membership and resulting DSPM access.

Forcepoint DSPM pattern matching is used to identify defined pieces of information inside scanned content by applying regular expressions. The documented function is discovery and classification: pattern matching identifies particular information in a document by using RegEx that attempts to match file content. This makes identifying personally identifiable information on SharePoint the correct use case. SharePoint is a supported Microsoft data source for scanning, and Forcepoint specifically documents SharePoint Online as a connector used to scan SharePoint accounts and apply classification tags to files containing sensitive data stored in SharePoint.

The key distinction is that pattern matching does not perform remediation actions such as redaction or encryption. Options B and D therefore overstate the capability: Forcepoint DSPM may discover and classify sensitive data that later informs controls, but the pattern itself is not a redaction or encryption engine. Option A is less precise in this context because the question is testing the canonical pattern-matching use case against scanned documents and repositories, while the strongest documented repository example among the choices is SharePoint. Pattern configuration can also assign classification, compliance, and distribution tags when a RegEx is detected, such as GDPR/PII tagging for identifiers. References/topics: Pattern Matching, RegEx, Compliance Tags, SharePoint Scanning, Sensitive Data Classification .

Click EDIT WIDGETS in the upper-right area of the dashboard.

Ella should click the EDIT WIDGETS button near the upper-right side of the dashboard, beside the EXPORT PDF button. This control opens the dashboard edit view, which exposes the controls required to modify dashboard content, including adding widgets and adding panels. In the screenshot, the correct click target is the green-outlined EDIT WIDGETS button above the dashboard panels.

Forcepoint documents dashboards as being primarily constructed from panels and widgets . A panel is the container that organizes one or more widgets, while widgets display selected datasets such as files, trustees, connectors, agents, or other DSPM analytics data. The Forcepoint documentation specifically states: “Edit Widgets: Click the Edit Widget button, to open the edit view.” It then lists Add widget and Add panel as functions available from that edit mode.

Therefore, Ella cannot add a panel by clicking the existing charts, the left navigation list, or the dashboard title. She must first enter edit mode through EDIT WIDGETS , then use the available Add panel option. References/topics: Analytics, Components of a Dashboard, Edit Widgets, Add Panel, Panels and Widgets .

The correct options are Yes/No, Select, and Text . In Forcepoint DSPM, Security Posture Policy Controls are configured under Policy Center > Compliance Hub > Data Mapping . These controls define the metadata fields that appear in the Data Asset Inventory , allowing data owners to describe and govern critical data assets using consistent business and compliance attributes. Forcepoint describes Data Mapping as the framework used to define fields available in the Data Asset Inventory so data owners can assign metadata tags to critical data. Examples include retention period, business owner, regulatory scope, review status, and project name.

The documented control types are Text , Yes/No , and Select . Text creates a free-form text field, useful for values such as project name or business context. Yes/No creates a binary drop-down, appropriate for simple governance questions such as whether a review is required. Select creates a predefined selection menu aligned with common data governance frameworks.

GQL query is not a Data Mapping control type; GQL is used elsewhere for search and Controls Orchestration rule conditions. Checkbox is also not listed as a supported Security Posture Policy Control option. References/topics: Compliance Hub, Data Mapping, Security Posture Policy Controls, Data Asset Inventory, Metadata Governance .

The correct answer is D. Head of Department . In Forcepoint DSPM Compliance Hub, Departments represent organisational business units such as HR, Finance, or Payment Processing. They are used to mirror the company’s functional structure inside the governance workflow so that policies, data assets, ownership responsibilities, and review activities can be aligned to the correct business stakeholders. Forcepoint states that Departments are configured by defining company departments and assigning department representatives, with department heads or business-unit representatives acting as primary points of contact.

The documented workflow for adding a department is explicit: click Add new department , then enter the Department name , Head of Department , and Notify At email address, then save. This makes Head of Department the required field among the options listed. The field is important because department heads receive governance-related notifications and, when they log in, see only the Security Posture Policies and Data Asset Inventory assigned to their department.

The distractors belong to other workflows. Chief Reviewer is not the department-creation field. Group Name relates to user or group administration, not Compliance Hub department definition. GQL data mapping is used for identifying data assets within DSPM policy/data-mapping logic, not for creating a department. References/topics: Compliance Hub, Departments, Department Representatives, Policy Center, Data Asset Inventory visibility .

Select the Actions drop-down in the upper-right corner of the LDAP provider screen, then choose Sync all users or Sync changed users .

Manual synchronization is initiated from the LDAP provider configuration page inside Keycloak User Federation, not from the general DSPM dashboard or from the Users page. The correct UI location is the Actions menu at the upper-right of the LDAP provider screen. In the screenshot, this is the open drop-down containing options such as Sync all users , Sync changed users , Unlink users , and Remove imported . To force synchronization after a successful connection test, choose Sync all users for a full import or Sync changed users when only deltas are required.

Forcepoint DSPM uses Keycloak for Active Directory import. The official DSPM documentation states that AD users are added through Keycloak , with administrators selecting the gv realm, navigating to User Federation , and adding/configuring an LDAP provider. It also identifies synchronization settings such as Import users , Periodic full sync , and Periodic changed users sync as the mechanisms used to bring LDAP users into Keycloak and then into DSPM.

Therefore, the click target is the upper-right Actions drop-down on the LDAP provider page , specifically the sync command within that menu. References/topics: User Federation, LDAP Provider, Active Directory Import, Keycloak gv Realm, Synchronization Settings .

The correct answer is C. Data Mapping . In Forcepoint DSPM, Security Posture Policies are used to define and govern critical business data assets, often referred to as crown-jewel data. Each policy represents a managed data asset associated with a department, owner, and query-based definition. The Data Mapping field is where the administrator enters or edits the GQL query that identifies which files or records belong to that data asset. Forcepoint’s documentation explicitly lists Asset Name , Department , Data Owner , and Data Mapping as required Security Posture Policy details, and defines Data Mapping as “a GQL query used to identify the data asset within the DSPM database.”

This distinction matters because Asset Name is only the business label, Department assigns responsibility to a business unit, and Data Owner identifies the person or group accountable for monitoring and compliance. The actual technical selection logic is contained in Data Mapping , where GQL can match data across sources such as SMB and SharePoint using query criteria like source and path. References/topics: Policy Center, Data Register, Security Posture Policies, Data Mapping, GQL, Data Asset Inventory .