In policies that include Exact Data Matching, which action is performed by Endpoint Discover?

In policies that include Exact Data Matching, which action is performed by Endpoint Discover?

• A. Quarantine File/Endpoint
• B. Block Access
• C. Encrypt Data
• D. Notify User

Answer: (A)

Endpoint Discover is designed to enforce responses on endpoints when exact data matches are found. When a policy uses Exact Data Matching, the strongest containment action it can take is to quarantine the affected data or the endpoint itself. Quarantining isolates the file or the device carrying the matched sensitive data, preventing further access or exfiltration until a review or remediation can occur. This immediate containment is why quarantining the file or endpoint is the best-fit action for EDM scenarios on Endpoint Discover. The other options are less aligned with the typical EDM enforcement on endpoints: blocking access is possible in other contexts but EDM on Endpoint Discover emphasizes containment, encryption is not a standard automatic response for an exact data match, and notifying the user is secondary to preventing data loss.

Endpoint Discover is designed to enforce responses on endpoints when exact data matches are found. When a policy uses Exact Data Matching, the strongest containment action it can take is to quarantine the affected data or the endpoint itself. Quarantining isolates the file or the device carrying the matched sensitive data, preventing further access or exfiltration until a review or remediation can occur. This immediate containment is why quarantining the file or endpoint is the best-fit action for EDM scenarios on Endpoint Discover.

The other options are less aligned with the typical EDM enforcement on endpoints: blocking access is possible in other contexts but EDM on Endpoint Discover emphasizes containment, encryption is not a standard automatic response for an exact data match, and notifying the user is secondary to preventing data loss.