NSE4 · Question #60
For data leak prevention, which statement describes the difference between the block and quarantine actions?
The correct answer is A. A block action prevents the transaction.. In Data Leak Prevention (DLP), a block action immediately prevents a transaction that violates a policy, while a quarantine action typically holds the offending data for review or further processing.
Question
For data leak prevention, which statement describes the difference between the block and quarantine actions?
Options
- AA block action prevents the transaction.
- BA block action prevents the transaction.
- CA block action has a finite duration.
- DA block action is used for known users.
How the community answered
(46 responses)- A91% (42)
- B2% (1)
- C2% (1)
- D4% (2)
Why each option
In Data Leak Prevention (DLP), a block action immediately prevents a transaction that violates a policy, while a quarantine action typically holds the offending data for review or further processing.
A block action in DLP is a definitive measure that immediately stops the communication or transaction containing sensitive data, preventing it from reaching its destination, thus directly preventing the data leak.
This statement is a duplicate of the correct answer and does not describe a difference between block and quarantine actions.
A block action is typically an immediate and permanent prevention of the specific transaction, without a finite duration tied to the block itself; quarantine might involve a review period, but not blocking.
DLP block actions are based on the content of the data and policy violations, regardless of whether the user initiating the transaction is known or unknown.
Concept tested: DLP block vs quarantine actions
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/13360/data-leak-prevention
Topics
Community Discussion
No community discussion yet for this question.