How should a DLP administrator change a policy so that it retains the original file when an endpoint incident has detected a “cope to USB device” operation?
A. Add a “Limit Incident Data Retention” response rule with “retain Original Message” option selected.
B. Modify the agent config.db to include the file
C. Modify the “Endpoint_Retain_Files.int” setting in the Endpoint server configuration
D. Modify the agent configuration and select the option “retain Original Files”