350-201 Question 102
Select 4A company is implementing a Data Loss Prevention (DLP) strategy to protect sensitive information transmitted via email and cloud storage. As a security engineer, you are tasked with configuring mechanisms to detect and enforce DLP policies. Which of the following mechanisms should you configure to ensure effective DLP enforcement?
- A
Content-based inspection to identify sensitive data within email attachments
- B
SSL decryption to analyze encrypted traffic for policy violations
- C
Role-based access control (RBAC) to restrict user access to sensitive files
- D
Keyword matching to detect specific patterns in data transmissions
- E
Anomaly detection to identify unusual patterns of sensitive data movement
Show answer and explanation
Correct answers: A, B, D, E
Explanation
Effective DLP enforcement relies on multiple mechanisms to ensure sensitive data is protected. Content-based inspection, SSL decryption, keyword matching, and anomaly detection work together to identify and control the movement of sensitive information, whether through email, cloud services, or encrypted channels. While RBAC is critical for access management, it does not directly address DLP enforcement mechanisms.
- A. Correct.
Content-based inspection is a core technique in DLP solutions, used to analyze and identify sensitive information such as PII, credit card numbers, or intellectual property inside attachments or text.
- B. Correct.
SSL decryption is necessary to inspect encrypted traffic for sensitive data and enforce DLP policies, as encrypted communication can bypass traditional DLP mechanisms.
- C. Incorrect.
While RBAC is important for access control, it does not directly detect or enforce DLP policies, as it focuses on permissions rather than data movement or content analysis.
- D. Correct.
Keyword matching is a fundamental DLP mechanism that helps detect sensitive data by identifying predefined patterns, such as keywords or regular expressions.
- E. Correct.
Anomaly detection is an advanced DLP approach to identify deviations from normal data usage patterns, such as unusual file transfers, which could indicate a potential data breach.