Which two automated response rules will be active in policies that include Exact Data Matching detection rule?

Which two automated response rules will be active in policies that include Exact Data Matching detection rule?

• A. Endpoint Discover: Quarantine File/Endpoint and Endpoint Prevent: Block
• B. Quarantine Endpoint: Delete and Notify Admin
• C. Encrypt Data and Notify User
• D. Block Access and Email Admin

Answer: (A)

Exact Data Matching detection is used for high-confidence identification of sensitive data, and policies that include EDM are designed to contain the data immediately to stop any leakage. The two active automated responses are to quarantine the file or the endpoint where the match occurred, and to block the endpoint to prevent further access or transmission of that data. Quarantining isolates the identified item so it can’t be opened or moved, while blocking the endpoint enforces a halt to data flow, reducing the risk of exfiltration. Other options like deleting the file, encrypting data, or notifying an admin don’t provide the same immediate containment for EDM-driven policies, so they aren’t the standard pair of automatic responses in this scenario.

Exact Data Matching detection is used for high-confidence identification of sensitive data, and policies that include EDM are designed to contain the data immediately to stop any leakage. The two active automated responses are to quarantine the file or the endpoint where the match occurred, and to block the endpoint to prevent further access or transmission of that data. Quarantining isolates the identified item so it can’t be opened or moved, while blocking the endpoint enforces a halt to data flow, reducing the risk of exfiltration. Other options like deleting the file, encrypting data, or notifying an admin don’t provide the same immediate containment for EDM-driven policies, so they aren’t the standard pair of automatic responses in this scenario.