How Should a DLP Administrator Change a Policy So That

How should a DLP administrator change a policy so that it retains the original file when an endpoint incident has detected a "copy to USB device" operation?

A) Add a "Limit Incident Data Retention" response rule with "Retain Original Message" option selected.
B) Modify the agent config.db to include the file
C) Modify the "Endpoint_Retain_Files.int" setting in the Endpoint server configuration
D) Modify the agent configuration and select the option "Retain Original Files"