nerdexam
Fortinet

NSE4 · Question #437

Of the following information, what can be recorded by a Data Leak Prevention sensor configured to do a summary archiving? (Choose three.)

The correct answer is B. Sender email address (for the case of SMTP traffic) C. Recipient email address (for the case of SMTP traffic) E. Email body (for the case of SMTP traffic). A Data Leak Prevention sensor configured for summary archiving records metadata like sender and recipient email addresses and the email body for SMTP traffic, but not typically the full attached files.

Submitted by tunde_lagos· Apr 18, 2026Security Profiles and Content Inspection

Question

Of the following information, what can be recorded by a Data Leak Prevention sensor configured to do a summary archiving? (Choose three.)

Options

  • AVisited URL (for the case of HTTP traffic)
  • BSender email address (for the case of SMTP traffic)
  • CRecipient email address (for the case of SMTP traffic)
  • DAttached file (for the case of SMTP traffic)
  • EEmail body (for the case of SMTP traffic)

How the community answered

(45 responses)
  • A
    9% (4)
  • B
    76% (34)
  • D
    16% (7)

Why each option

A Data Leak Prevention sensor configured for summary archiving records metadata like sender and recipient email addresses and the email body for SMTP traffic, but not typically the full attached files.

AVisited URL (for the case of HTTP traffic)

Visited URL (HTTP) is not directly related to SMTP traffic, which is the context specified for options B, C, D, E.

BSender email address (for the case of SMTP traffic)Correct

For SMTP traffic, DLP sensors are designed to inspect and log metadata such as the sender's email address as part of their function to identify and prevent data exfiltration.

CRecipient email address (for the case of SMTP traffic)Correct

DLP sensors will capture the recipient's email address in SMTP traffic to track who data is being sent to, which is crucial for data loss prevention policies.

DAttached file (for the case of SMTP traffic)

Summary archiving typically implies recording metadata and core content, not the entire attached file itself, which would be considered full archiving and generate much larger logs.

EEmail body (for the case of SMTP traffic)Correct

The email body contains text data that is directly inspected by DLP for sensitive information and is typically recorded in a summary archiving context, even if full attachments are not.

Concept tested: DLP summary archiving capabilities

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/523773/dlp-archive-and-quarantine

Topics

#DLP#Content Inspection#Logging#Archiving#SMTP Security

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice