What is the recommended approach to ensuring DLP case closures record a standardized root cause?

• A. Customize the Close Case dialog to add the five DLP event types as root cause options.
• B. Customize the Case Name format to include the DLP event type.
• C. Create a SOAR playbook that auto-assigns case tags.
• D. Create case tags and have analysts assign them manually.

Answer: (A)

Capturing a consistent, auditable root cause during the closure of DLP cases is the key idea. The best approach is to customize the Close Case dialog so that the five DLP event types are presented as fixed root-cause options. By embedding the standard root-cause vocabulary directly into the closure process, you ensure every case is categorized in a uniform way, which makes reporting, trend analysis, and downstream automation reliable. Analysts select from predefined choices, reducing free‑text variability and ambiguity, and enabling accurate metrics and faster remediation actions.

Changing the Case Name format won’t standardize the root cause and provides little value for analytics or automation. Relying on a SOAR playbook to auto-assign case tags helps with tagging but still doesn’t enforce a standardized root-cause entry at closure. Having analysts manually assign case tags also leaves room for inconsistency and incomplete data, making it harder to derive meaningful insights or trigger automated workflows.