NSE4 · Question #437
Of the following information, what can be recorded by a Data Leak Prevention sensor configured to do a summary archiving? (Choose three.)
The correct answer is B. Sender email address (for the case of SMTP traffic) C. Recipient email address (for the case of SMTP traffic) E. Email body (for the case of SMTP traffic). A Data Leak Prevention sensor configured for summary archiving records metadata like sender and recipient email addresses and the email body for SMTP traffic, but not typically the full attached files.
Question
Of the following information, what can be recorded by a Data Leak Prevention sensor configured to do a summary archiving? (Choose three.)
Options
- AVisited URL (for the case of HTTP traffic)
- BSender email address (for the case of SMTP traffic)
- CRecipient email address (for the case of SMTP traffic)
- DAttached file (for the case of SMTP traffic)
- EEmail body (for the case of SMTP traffic)
How the community answered
(45 responses)- A9% (4)
- B76% (34)
- D16% (7)
Why each option
A Data Leak Prevention sensor configured for summary archiving records metadata like sender and recipient email addresses and the email body for SMTP traffic, but not typically the full attached files.
Visited URL (HTTP) is not directly related to SMTP traffic, which is the context specified for options B, C, D, E.
For SMTP traffic, DLP sensors are designed to inspect and log metadata such as the sender's email address as part of their function to identify and prevent data exfiltration.
DLP sensors will capture the recipient's email address in SMTP traffic to track who data is being sent to, which is crucial for data loss prevention policies.
Summary archiving typically implies recording metadata and core content, not the entire attached file itself, which would be considered full archiving and generate much larger logs.
The email body contains text data that is directly inspected by DLP for sensitive information and is typically recorded in a summary archiving context, even if full attachments are not.
Concept tested: DLP summary archiving capabilities
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/523773/dlp-archive-and-quarantine
Topics
Community Discussion
No community discussion yet for this question.