Which Network Prevent action takes place when the Network Incident list shows the message is 'Modified'?

Which Network Prevent action takes place when the Network Incident list shows the message is 'Modified'?

• A. Block the email entirely
• B. Add one or more SMTP headers to an email
• C. Encrypt the email
• D. Notify administrator

Answer: (B)

When a Network Prevent action results in the message being labeled as “Modified,” the email has been altered in transit to meet a policy, rather than being simply blocked or encrypted. The common way this modification is implemented at the gateway is by adding one or more SMTP headers to the message that describe the DLP action taken and the policy involved. These headers signal to downstream systems and recipients that the content was changed to protect data, while the message still moves through the mail path. This is why adding SMTP headers best fits the “Modified” outcome. Blocking would stop delivery, encryption would conceal content, and notifying an administrator would generate an alert rather than altering the message itself.

When a Network Prevent action results in the message being labeled as “Modified,” the email has been altered in transit to meet a policy, rather than being simply blocked or encrypted. The common way this modification is implemented at the gateway is by adding one or more SMTP headers to the message that describe the DLP action taken and the policy involved. These headers signal to downstream systems and recipients that the content was changed to protect data, while the message still moves through the mail path. This is why adding SMTP headers best fits the “Modified” outcome. Blocking would stop delivery, encryption would conceal content, and notifying an administrator would generate an alert rather than altering the message itself.