350-201 Question 101
Select 3A financial institution wants to implement a data loss prevention (DLP) strategy to secure sensitive customer data such as personally identifiable information (PII) and financial records. Which mechanisms should be employed to detect and enforce DLP policies effectively?
- A
Content-based inspection to identify sensitive data patterns such as Social Security Numbers or credit card numbers
- B
Endpoint device monitoring to prevent unauthorized file transfers or printing of sensitive information
- C
Network behavior analysis to identify anomalies in traffic unrelated to data exfiltration
- D
Email filtering to block outgoing messages containing unencrypted sensitive data
- E
File integrity monitoring to detect unauthorized changes to sensitive files
Show answer and explanation
Correct answers: A, B, D
Explanation
Data loss prevention (DLP) strategies rely on mechanisms that can detect sensitive data and enforce policies to prevent its unauthorized access or exfiltration. Content-based inspection, endpoint device monitoring, and email filtering are all critical for identifying and controlling the flow of sensitive data. While network behavior analysis and file integrity monitoring are useful in broader security strategies, they are not directly designed for DLP enforcement.
- A. Correct.
Content-based inspection is a core mechanism in DLP strategies to detect patterns of sensitive data (e.g., PII, credit card numbers) as they traverse the network or are accessed on endpoints.
- B. Correct.
Endpoint device monitoring is critical for enforcing DLP policies, as it prevents sensitive data from being transferred to unauthorized devices or printed.
- C. Incorrect.
Network behavior analysis is more focused on detecting general traffic anomalies, such as unusual bandwidth usage, and is not directly used for DLP enforcement.
- D. Correct.
Email filtering is an essential DLP technique to prevent sensitive information from being sent outside the organization without encryption or approval.
- E. Incorrect.
File integrity monitoring is useful for detecting changes to files but does not enforce DLP policies or prevent data exfiltration.