350-201 Question 104
Select 3An organization wants to prevent sensitive customer data from being shared outside its corporate network. As a cybersecurity specialist, you are tasked with implementing data loss prevention (DLP) solutions. Which of the following mechanisms can be used to detect and enforce DLP policies effectively?
- A
Content-based inspection to analyze files and emails for sensitive information.
- B
User behavior monitoring to identify anomalous activity related to data access.
- C
Encrypting all outbound traffic to prevent unauthorized access.
- D
Endpoint agents to block unauthorized data transfers from workstations.
- E
Using firewalls to restrict access to specific external IP addresses.
Show answer and explanation
Correct answers: A, B, D
Explanation
Effective data loss prevention (DLP) requires a combination of detection and enforcement mechanisms. Content-based inspection and user behavior monitoring are critical for detecting sensitive data or risky actions. Endpoint agents enforce policies directly on devices to prevent data leaks. While encryption and firewalls enhance security, they do not specifically address DLP detection or enforcement tasks.
- A. Correct.
Content-based inspection is a key DLP mechanism that analyzes the content of files, emails, or other data streams to identify and enforce policies on sensitive information. This is a valid detection and enforcement method.
- B. Correct.
User behavior monitoring is relevant in DLP as it helps identify unusual or risky activity, such as unexpected data exfiltration attempts, which can then trigger enforcement actions.
- C. Incorrect.
Encrypting outbound traffic is a security best practice but does not directly contribute to detecting or enforcing DLP policies, as it primarily protects data in transit rather than identifying or blocking sensitive data leaks.
- D. Correct.
Endpoint agents are integral to DLP enforcement as they monitor and control data transfers directly from user devices, such as blocking USB file transfers or unauthorized uploads.
- E. Incorrect.
Firewalls are network security tools designed to manage traffic access, but by themselves, they do not provide content-level inspection or enforcement of DLP policies.