Sophos Certified Engineer Practice Exam

Where in Sophos Central do you change the action for 'confidential' content?

1. In the Data Loss Prevention Rule

2. In the Threat Response Dashboard

3. In the Policy Management section

4. In the Alerts Configuration page

The correct answer is: In the Data Loss Prevention Rule

The correct choice reflects the place within Sophos Central where you specifically manage and configure actions related to 'confidential' content. The Data Loss Prevention (DLP) Rule section is tailored for setting up and modifying rules that control how sensitive information is handled. This includes defining what constitutes 'confidential' content and stipulating the necessary actions to take when such content is detected, whether that means blocking access, notifying users, or logging incidents for further investigation. The other options, while relevant to different features or aspects of security management, do not focus on the configuration of DLP rules specifically. The Threat Response Dashboard is primarily used for monitoring and managing security incidents rather than defining content-specific actions. Policy Management encompasses a broader range of security policies but does not specifically deal with DLP actions for confidential content. Similarly, the Alerts Configuration page is meant for managing alert notifications rather than defining specific actions for content classification. Therefore, the Data Loss Prevention Rule aspect is uniquely designed for this purpose, making it the most appropriate choice.