County counsel forbids forwarding civic Exchange messages from phones to personal Gmail. Which control point enforces that email sharing restriction?
Select an answer to reveal the explanation.
Short Explanation
Stopping a forward is a mail-app rule, not a VPN hose clamp. Tunnel can carry the work-order app to the LAN, Blast paints a desktop, and DEM never sits on iOS. The control point is managed Boxer under UEM email policy.
Full Explanation
Forwarding and sharing restrictions on civic Exchange messages are data-loss-prevention controls enforced on the managed mail client—Workspace ONE Boxer—through Workspace ONE UEM email policies. County counsel's prohibition on forwarding to personal Gmail is therefore implemented as Boxer and UEM policy, not as an incidental network side effect. Municipal records policies for counsel and case mail depend on that client-side DLP so personal cloud mailboxes never become an unofficial archive of city correspondence. Workspace ONE Tunnel provides per-app access to internal resources; blocking Gmail DNS is not how mailbox forwarding DLP is designed or tested on this exam. Horizon Blast Extreme is a display protocol for remote desktops and cannot be the control that prevents forwarding from a mobile mail application. Dynamic Environment Manager owns Windows user-environment settings on Horizon desktops and does not provide mobile email DLP. Exam caveat: Technically flavored distractors (VPN, protocol, profile tools) fail when the requirement is explicitly an email sharing restriction on phones. Operational check: From Boxer on a managed test phone, attempt a forward to a personal address and confirm UEM policy blocks or strips the action, then review the assigned email DLP settings in the UEM console.