2.14 Describe the Different Mechanisms to Detect and Enforce Data Loss Prevention Techniques 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company uses Microsoft 365 and stores sensitive documents in SharePoint Online. The security team wants to detect when users share these documents externally via email or links, and automatically block the sharing if it violates policy. Which DLP approach should be implemented?

   • AConfigure a cloud-based DLP policy in Microsoft 365 that scans content in SharePoint and Exchange Online and blocks external sharing.
   • BUse an application-based DLP plugin for Outlook that blocks external recipients.
   • CDeploy a network-based DLP sensor at the company's internet egress to inspect traffic to Microsoft 365.
   • DInstall host-based DLP agents on all endpoints to monitor browser uploads to SharePoint.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which statement accurately describes a host-based DLP agent's ability to monitor data in motion?

   • AIt can monitor and block sensitive data sent through webmail or instant messaging applications on the endpoint.
   • BIt can inspect only traffic that traverses the corporate firewall.
   • CIt can only monitor data at rest and has no visibility into data in motion.
   • DIt can decrypt all TLS traffic regardless of the application or certificate.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A healthcare organization has a mix of desktop workstations and mobile devices used by clinicians. They want to prevent patient data from being written to USB drives and also detect when large amounts of data are transferred over the network to external IPs. Which DLP approach should be used?

   • AUse only a network-based DLP sensor to monitor USB activity and network traffic.
   • BDeploy host-based DLP agents on all devices to block USB writes, and a network-based DLP sensor to monitor outbound traffic.
   • CConfigure application-based DLP for the EHR system to block exports.
   • DUse only host-based DLP agents to monitor network traffic.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is moving its customer database to an AWS S3 bucket and wants to prevent sensitive data from being uploaded to the bucket from the corporate network. They also want to monitor for accidental public exposure of the bucket. Which combination of DLP mechanisms would best address both requirements?

   • AUse a network DLP sensor to block uploads to S3 and enable AWS Macie to detect public bucket exposure.
   • BDeploy a host-based DLP agent on all workstations to block S3 uploads and rely on S3 server access logs.
   • CUse AWS CloudTrail to monitor all S3 API calls and block public access via bucket policies.
   • DImplement an application-based DLP plugin for the AWS console that blocks S3 uploads.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company uses a SaaS CRM system and wants to prevent users from exporting customer data to CSV files. They also want to allow authorized users to export data for reporting. Which DLP mechanism would be the most appropriate?

   • AUse a host-based DLP agent to block all CSV file creation on workstations.
   • BDeploy a network DLP sensor to block CSV downloads from the CRM.
   • CUse the CRM's built-in DLP features to restrict export actions based on user roles.
   • DConfigure a cloud-based DLP policy that blocks all exports from the CRM.
   Reveal Solution Discussion Select an answer first