When two or more DLP rules are matched, the action taken is the most restrictive action. Rank the following items from the lowest restriction level (1) to the highest (4).
1. Ask User
2. Prevent
3. Detect
4. Inform User
A.
3,4,1,2
B.
3,1,4,2
C.
4,3,1,2
D.
4,1,3,2
Should be “A”
Detect The data transmission event is logged in SmartView Tracker. Administrators with permission
can view the data that was sent.
The traffic is passed.
Inform User The transmission is passed, but the incident is logged and the user is notified.
Ask User The transmission is held until the user verifies that it should be sent. A notification, usually
with a remediation link to the Self Incident Handling portal, is sent to the user. The user
decides whether the transmission should be completed or not. The decision is logged and
can be viewed under the User Actions category in SmartView Tracker. Administrators that
have full permissions or the View/Release/Discard DLP messages permission can also
decide if to send or discard the message.
Prevent The data transmission is blocked.
A is the right answer .