What is the default fallback option for the Endpoint Prevent Encrypt response rule?

What is the default fallback option for the Endpoint Prevent Encrypt response rule?

• A. Notify
• B. Encrypt
• C. Block
• D. Quarantine

Answer: (A)

When Endpoint Prevent Encrypt can’t complete encryption for a data item, there needs to be a safe, non-disruptive way to handle it. The default fallback is to Notify, which surfaces a message to the user or a security analyst about the situation rather than blocking the file or quarantining it. This preserves workflow while still creating visibility for remediation. Other options would be more disruptive—blocking or quarantining the item, or attempting to encrypt again—so notifying is the safest, most practical fallback by default.

When Endpoint Prevent Encrypt can’t complete encryption for a data item, there needs to be a safe, non-disruptive way to handle it. The default fallback is to Notify, which surfaces a message to the user or a security analyst about the situation rather than blocking the file or quarantining it. This preserves workflow while still creating visibility for remediation. Other options would be more disruptive—blocking or quarantining the item, or attempting to encrypt again—so notifying is the safest, most practical fallback by default.