SY0-701 Question 334
Single answerDLPA company recently allowed employees to use personal email and cloud storage sites from corporate laptops. Within a month, the security team discovered several incidents in which customer records containing Social Security numbers were emailed to personal accounts and uploaded to unsanctioned file-sharing services. Management wants a control that can identify sensitive data in use, in motion, and at rest, and then block or quarantine unauthorized transfers with the least manual effort. Which of the following is the BEST solution?
- A
Implement a data loss prevention (DLP) solution with content inspection policies for PII and outbound enforcement
- B
Deploy full-disk encryption on all corporate laptops and require preboot authentication
- C
Enable network address translation (NAT) for outbound traffic from employee workstations
- D
Configure a web application firewall (WAF) to filter traffic to approved SaaS platforms only
Show answer and explanation
Correct answer: A
Explanation
The best answer is a DLP solution because the requirement is to identify sensitive information such as personally identifiable information (PII) and prevent unauthorized transmission across multiple states of data: in use, in motion, and at rest. This aligns with standard DLP use cases in enterprise security programs. In practice, organizations deploy endpoint DLP agents, email DLP, and network/cloud DLP controls to inspect content and enforce rules such as blocking uploads, quarantining messages, or generating alerts. Full-disk encryption is important for protecting stored data on lost or stolen systems, but it does not stop intentional or accidental exfiltration by a logged-in user. NAT provides no content inspection, and a WAF is intended to protect web applications rather than enforce enterprise-wide data handling policies. This approach is consistent with common Security+ guidance and with industry best practices from vendors and frameworks that recommend DLP for monitoring and controlling sensitive data movement.
- A. Correct.
Correct. A DLP solution is specifically designed to discover, monitor, and protect sensitive data at rest, in motion, and in use. In this scenario, the organization needs to detect customer records containing Social Security numbers and prevent users from sending that data to personal email accounts or unsanctioned cloud services. Content inspection policies, exact data matching, pattern matching for PII, and policy-based actions such as blocking, quarantining, or alerting are core DLP capabilities that directly address the problem with minimal manual effort.
- B. Incorrect.
Incorrect. Full-disk encryption protects data stored on a device if the laptop is lost or stolen, but it does not prevent an authorized user from emailing or uploading sensitive files to unauthorized destinations. Someone might choose this option because it protects data at rest, but it does not address exfiltration by users during normal operation.
- C. Incorrect.
Incorrect. NAT hides internal IP addresses and helps conserve public address space, but it does not inspect file contents for Social Security numbers or stop sensitive documents from being transmitted. This distractor reflects a common misconception that general network controls can provide content-aware data protection.
- D. Incorrect.
Incorrect. A WAF protects web applications by filtering and monitoring HTTP traffic to and from specific web apps. While it may help secure company-hosted applications, it is not the best control for identifying and blocking sensitive data sent through personal email or third-party file-sharing services across multiple channels. Someone might choose this because cloud traffic is involved, but a WAF is not a comprehensive data exfiltration control.