How should a DLP administrator change a policy so that it retains the original file when an endpoint incident has detected a “cope to USB device” operation?

How should a DLP administrator change a policy so that it retains the original file when an endpoint incident has detected a “cope to USB device” operation?
A . Add a “Limit Incident Data Retention” response rule with “retain Original Message” option selected.
B . Modify the agent config.db to include the file
C . Modify the “Endpoint_Retain_Files.int” setting in the Endpoint server configuration
D . Modify the agent configuration and select the option “retain Original Files”

View Answer

Answer: A