When two or more DLP rules are matched, the action taken is the most restrictive action. Rank the
following items from the lowest restriction level (1) to the highest (4).
1. Ask User
2. Prevent
3. Detect
4. Inform User
A.
3,4,1,2
B.
3,1,4,2
C.
4,3,1,2
D.
4,1,3,2
Explanation:
Action of rule is performed.
– If the matched rule is set to Detect, the user gets no notification. A DLP log incident is created, and the actual data is stored.
– If the matched rule is set to Inform User, DLP notifies the user that the captured traffic violates DLP rules. The traffic is passed.
– If the matched rule is set to Ask User, DLP notifies the user that the message is being held and contains a link to the DLP Portal, where the user decides whether the transmission should go through or be dropped. User decisions, and reasons for sending, are logged for your analysis.
– If the matched rule is set to Prevent, the traffic is blocked. The user and the Data Owner may be notified.
So answer should be A
0
0