220-1102 Question 352
Single answerData loss prevention (DLP)A company allows employees to work with customer records that include credit card numbers and Social Security numbers. The help desk keeps seeing incidents where users accidentally email spreadsheets with this sensitive data to personal email accounts so they can work from home. Management wants to reduce these accidental disclosures without completely blocking legitimate internal business communication. Which solution would BEST address this requirement?
- A
Implement a data loss prevention (DLP) policy that scans outgoing email and attachments for sensitive data patterns and warns, blocks, or encrypts messages based on policy
- B
Disable all spreadsheet applications on company devices so users cannot attach files to email
- C
Require users to change their passwords every 30 days to reduce the chance of data being sent externally
- D
Install full-disk encryption on employee laptops so spreadsheet files cannot leave the company by email
Show answer and explanation
Correct answer: A
Explanation
The best answer is the DLP policy because the scenario is specifically about preventing accidental exposure of sensitive data through outbound email without stopping legitimate internal use. DLP solutions are intended to monitor, detect, and control sensitive information in motion, such as email messages and attachments, and can often apply actions like alerting, blocking, quarantining, or encrypting based on rules. This directly fits A+ Core 2 security objectives around organizational policies and data protection. Best practices from major vendors and security guidance commonly recommend using DLP for regulated or sensitive data such as payment card information and PII, especially when the concern is unintentional exfiltration by users rather than device theft or account compromise.
- A. Correct.
Correct. A DLP policy is designed to identify and control the movement of sensitive data such as payment card data and personally identifiable information. In this scenario, the goal is to reduce accidental disclosure through email while still allowing legitimate internal communication. Email-focused DLP can inspect message content and attachments, detect patterns like credit card or Social Security numbers, and then take an action such as warning the user, blocking external delivery, or applying encryption according to policy.
- B. Incorrect.
Incorrect. Disabling spreadsheet applications is overly disruptive and does not align with the requirement to continue legitimate business communication. Employees may need spreadsheets for normal job duties. This option removes productivity tools rather than applying targeted protection to sensitive data movement.
- C. Incorrect.
Incorrect. Password changes are part of account security, but they do not address the specific problem of users accidentally sending sensitive files to external email addresses. This is a common confusion between identity protection and data handling controls.
- D. Incorrect.
Incorrect. Full-disk encryption protects data at rest on the laptop if the device is lost or stolen. It does not prevent a logged-in user from attaching a file to an email and sending it outside the organization. This is a common misconception because encryption is useful, but it must be applied to the right risk.