2.14 Describe the Different Mechanisms to Detect and Enforce Data Loss Prevention Techniques 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which characteristic distinguishes application-based DLP from network-based DLP?

   • AApplication-based DLP operates at the application layer and can enforce policies based on the user's context within the application.
   • BApplication-based DLP is always deployed as a physical appliance.
   • CApplication-based DLP only monitors data at rest.
   • DApplication-based DLP requires an agent on every endpoint.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A hospital has a network-based DLP sensor that inspects all outbound traffic. They are seeing false positives where patient data is detected in encrypted traffic that is actually a secure VPN tunnel used by a remote clinic. The hospital also has host-based DLP agents on all managed devices. Which action would best reduce false positives while maintaining DLP coverage?

   • AEnable TLS interception on the network DLP sensor to inspect the VPN traffic.
   • BAdd an application-based DLP plugin to the VPN client to inspect data before encryption.
   • CConfigure the network DLP sensor to skip inspection of traffic to the remote clinic's VPN endpoint, and rely on host-based DLP agents to monitor data on managed devices.
   • DDisable the network DLP sensor and rely solely on host-based DLP agents.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A law firm uses a custom web-based document management system (DMS) that stores client files. The firm wants to prevent users from printing or downloading documents marked as 'confidential' from the DMS, while still allowing them to view the documents online. Which DLP mechanism would be the most effective to enforce this policy?

   • AImplement a cloud-based DLP policy that restricts access to the DMS from unmanaged devices.
   • BUse a host-based DLP agent to block all print and download operations on the user's workstation.
   • CConfigure a network DLP sensor to block HTTP responses containing confidential documents.
   • DDeploy an application-based DLP integration that hooks into the DMS and blocks print/download actions for confidential documents.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company uses a cloud-based DLP service that scans data in SaaS applications. They also have a network-based DLP sensor at the egress. The security team discovers that sensitive data is being exfiltrated via encrypted web traffic to a personal cloud storage service. Which control would be most effective to block this?

   • AInstall host-based DLP agents on all endpoints to monitor uploads.
   • BRely on the network-based DLP sensor to block the traffic.
   • CDeploy a CASB with inline DLP that can decrypt and inspect traffic to personal cloud storage services.
   • DUse the cloud-based DLP service to scan the personal cloud storage service.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company uses a custom CRM application that is hosted on-premises and also has a cloud-based version. The security team wants to enforce DLP on customer data in both environments, but the on-premises CRM does not support API integration. Which approach would provide the most consistent DLP enforcement?

   • AUse only a network-based DLP sensor to monitor traffic to both CRM systems.
   • BMigrate the on-premises CRM to the cloud and use cloud DLP for everything.
   • CDeploy host-based DLP agents on endpoints that access the on-premises CRM, and use cloud-based DLP for the cloud CRM.
   • DUse only an application-based DLP plugin for the on-premises CRM.
   Reveal Solution Discussion Select an answer first