Which statement is true about the relationship between IDC and BAD files in the incident folder?

Which statement is true about the relationship between IDC and BAD files in the incident folder?

• A. IDC files larger than 1MB become BAD files.
• B. BAD files are converted to IDC.
• C. IDC files are only created for failed detections.
• D. BAD files are archived after processing.

Answer: (A)

In DLP, incident data is written into IDC files as they’re collected. There’s a size guard on these IDC files: if an IDC file grows beyond 1 MB, it is converted to a BAD file rather than continuing as a normal IDC. This isolates oversized or problematic incidents so administrators can review or reprocess them without slowing the automatic pipeline. The BAD file isn’t automatically turned back into an IDC, and IDC files aren’t limited to failed detections only; nor are BAD files simply archived after processing in the standard flow.

In DLP, incident data is written into IDC files as they’re collected. There’s a size guard on these IDC files: if an IDC file grows beyond 1 MB, it is converted to a BAD file rather than continuing as a normal IDC. This isolates oversized or problematic incidents so administrators can review or reprocess them without slowing the automatic pipeline. The BAD file isn’t automatically turned back into an IDC, and IDC files aren’t limited to failed detections only; nor are BAD files simply archived after processing in the standard flow.