NSE4 · Question #254
Which of the following DLP actions will always be performed if it is selected?
The correct answer is A. Archive. The 'Archive' action in Data Loss Prevention (DLP) is always performed when selected because it passively copies data without interfering with traffic flow.
Question
Which of the following DLP actions will always be performed if it is selected?
Options
- AArchive
- BQuarantine Interface
- CBan Sender
- DBlock
- ENone
- FBan
- GQuarantine IP Address
How the community answered
(61 responses)- A89% (54)
- C5% (3)
- D2% (1)
- E3% (2)
- F2% (1)
Why each option
The 'Archive' action in Data Loss Prevention (DLP) is always performed when selected because it passively copies data without interfering with traffic flow.
The 'Archive' action in DLP involves making a copy of detected content for logging and analysis. Unlike active actions such as blocking or quarantining, archiving does not interrupt the actual flow of traffic, ensuring it is reliably performed as long as the logging or storage system is operational.
'Quarantine Interface' attempts to block an interface, which may fail due to active usage, network configuration, or system errors.
'Ban Sender' involves modifying sender reputation or blocking future traffic, which can be affected by other policies, identity availability, or system resources.
'Block' prevents traffic from passing, but its success depends on the traffic being detectable and not being overridden by other policies or system limitations.
'Ban' generally refers to blocking a source or user, which can encounter similar failure conditions as banning a sender or quarantining an IP.
'Quarantine IP Address' attempts to block an IP, which could fail if the IP is critical, already blocked, or if the system cannot enforce the quarantine effectively.
Concept tested: FortiGate DLP action reliability
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/798952/dlp-sensors
Topics
Community Discussion
No community discussion yet for this question.