In a Network Prevent content response rule, which action is appropriate when the content cannot be removed?

In a Network Prevent content response rule, which action is appropriate when the content cannot be removed?

• A. Block the content before posting
• B. Allow the content to be posted
• C. Remove the HTTP/HTTPS content response rule
• D. Notify administrator only

Answer: (A)

When content is detected by a Network Prevent content response rule and you can’t remove it from the message, blocking the content before posting is the appropriate action. This enforces the policy at the network edge, stopping the sensitive data from leaving the organization. If you allowed the content to be posted, the data would escape; removing the rule would disable enforcement entirely; and merely notifying an administrator doesn’t prevent the transmission in real time. Blocking provides immediate protection for data in motion.

When content is detected by a Network Prevent content response rule and you can’t remove it from the message, blocking the content before posting is the appropriate action. This enforces the policy at the network edge, stopping the sensitive data from leaving the organization. If you allowed the content to be posted, the data would escape; removing the rule would disable enforcement entirely; and merely notifying an administrator doesn’t prevent the transmission in real time. Blocking provides immediate protection for data in motion.