How should a DLP administrator change a policy that it retains the original file when an endpoint incident has detected a “copy to USB device” operation?
Options:
A.
Add a “Limit Incident Data Retention” response rule with “Retain Original Message” option selected
B.
Modify the agent configuration and select the option “Retain Original Files”
C.
Modify the agent config.db to include the file
D.
Modify the “Endpoint_Retain_Files.int” setting in the Endpoint server configuration
