How should a DLP administrator change a policy so that it retains the original file when an endpoint incident has detected a "cope to USB device" operation?

Which server target uses the "Automated Incident Remediation Tracking" feature in Symantec DLP?

A DLP administrator determines that the \SymantecDLP\Protect\Incidents folder on the Enforce server contains. BAD files dated today, while other. IDC files are flowing in and out of the \Incidents directory.
Only .IDC files larger than 1MB are turning to .BAD files.
What could be causing only incident data smaller than 1MB to persist while incidents larger than 1MB change to .BAD files?

When managing an Endpoint Discover scan, a DLP administrator notices some endpoint computers are NOT completing their scans.
When does the DLP agent stop scanning?

Which two (2) DLP products support Optical Character Recognition (OCR)? (Choose two.)