Symantec
250-513 · Question #72
An incident response team has determined that multiple incidents are resulting from the same user action of copying sensitive data to USB devices. Which action should the incident response team take…
The correct answer is B. combine multiple conditions into one compound rule. See the full explanation below for the reasoning.
Question
An incident response team has determined that multiple incidents are resulting from the same user action of copying sensitive data to USB devices. Which action should the incident response team take to fix this issue so only one incident per action is detected?
Options
- Acreate separate policies for the different detection methods
- Bcombine multiple conditions into one compound rule
- Cchange which 'Endpoint Destinations' are monitored
- Dchange the monitor/ignore filters in the agent configuration
How the community answered
(36 responses)- A11% (4)
- B81% (29)
- C6% (2)
- D3% (1)
Community Discussion
No community discussion yet for this question.