156-315.75 · Question #616
Which DLP action would describe the following action: The data transmission event is logged in SmartView Tracker. Administrators with permission can view the data that was sent. The traffic is passed.
The correct answer is A. Detect. See the full explanation below for the reasoning.
Question
Which DLP action would describe the following action: The data transmission event is logged in SmartView Tracker. Administrators with permission can view the data that was sent. The traffic is passed.
Options
- ADetect
- BAsk User
- CInform User
- DPrevent
How the community answered
(32 responses)- A84% (27)
- B3% (1)
- C3% (1)
- D9% (3)
Community Discussion
7
Ola B.May 9, 2026Detect is your answer. That action logs the event in SmartView Tracker, lets permissioned admins review the transmitted data, and lets the traffic pass through without blocking or alerting anyone, which is exactly what Detect does compared to Prevent, Ask User, or Inform User.
Lena V.May 12, 2026Solid breakdown, though worth flagging for the exam that Inform User does generate a visible notification to the sender, so if a question asks which action is completely silent to both the user and the security team, Detect is your only pick.
Bahar F.May 15, 2026Detect logs and passes, never blocks. Saw this exact wording on my 315.75 sitting, elimination of Prevent and Ask User got me there fast.
Bao N.May 15, 2026Solid tip, though on my sittings I have also seen Prompt User show up as a trap answer alongside Ask User, so keep that one on your radar too.
Lena V.May 6, 2026Detect is the right call here because it is purely passive, the traffic flows through untouched and the only thing that happens is a log entry in SmartView Tracker that privileged admins can review later. Ask User stops and prompts the sender, Inform User lets the traffic pass but notifies the user directly, and Prevent blocks the transmission outright, so none of those match a scenario where the user sees nothing and the data keeps moving. The key phrase to lock onto is "traffic is passed" combined with "administrators with permission can view the data," which is the fingerprint of a logging-only action with no user-facing interruption. When I sat for 156-315.75 last spring, I second-guessed myself on a question almost identical to this one and nearly picked Inform User because I conflated "someone is notified" with "admin can view logs," but caught myself and remembered that Inform User sends a notification to the actual sender, not just to admins in a tracker, which sealed it for A.
Bao N.Apr 24, 2026Went back and forth on this one but I keep landing on C, Inform User. The key phrase for me is that the traffic is passed AND the event is logged with the data visible to admins, which lines up with Inform User because that action notifies someone while still letting the transmission go through. Detect feels too passive to me since it implies no notification component, just silent logging, but the scenario specifically calls out that admins can view the data, which suggests a more active awareness step is built into the action. I have seen a few questions in this set where they try to blur the line between Detect and Inform User, but the visibility piece to admins with permission is what tips it for me toward C. Going with Inform User, pretty confident on this one.
Ola B.Apr 25, 2026Good reasoning on the visibility piece, Bao, but the admin log access is actually what defines Detect here, since that action captures the event and makes it available for review without pushing any notification out, whereas Inform User would mean the end user or another party gets actively alerted, which the scenario does not describe.