2.14 Describe the Different Mechanisms to Detect and Enforce Data Loss Prevention Techniques 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A company uses Microsoft 365 and wants to protect data in SharePoint and OneDrive. Which cloud-based DLP approach is most suitable?

   • ADatabase firewall that monitors SQL queries to SharePoint
   • BAPI-based DLP that connects to Microsoft 365 APIs to scan and classify content
   • CHost-based DLP agent installed on the SharePoint servers
   • DInline network DLP sensor placed in front of the cloud service
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company uses a cloud-based DLP service for its SaaS applications, but the security team is concerned about data exfiltration via personal cloud storage services like Dropbox and Google Drive. They have a network-based DLP sensor at the egress, but it cannot inspect encrypted traffic. Which approach would provide the most effective control?

   • ARely on the network-based DLP sensor to block access to personal cloud storage.
   • BUse the cloud-based DLP service to scan data in personal cloud storage.
   • CInstall host-based DLP agents on all endpoints to monitor uploads to personal cloud storage.
   • DDeploy a cloud access security broker (CASB) that uses API-based DLP to scan data stored in sanctioned cloud services and inline controls to block uploads to unsanctioned services.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which limitation is most commonly associated with network-based DLP sensors?

   • AThey are unable to block traffic and can only generate alerts.
   • BThey can only monitor data at rest on file servers.
   • CThey require an agent to be installed on every endpoint.
   • DThey cannot inspect encrypted traffic unless decryption is performed or the sensor has visibility into the plaintext.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is migrating its email system to a cloud-based SaaS provider. The security team wants to enforce DLP on email content both in transit and at rest, and also block malicious data exfiltration to personal email accounts. Which DLP mechanism should be the primary control?

   • ADeploy a network-based DLP sensor at the corporate internet egress to inspect SMTP traffic.
   • BInstall host-based DLP agents on all endpoints to monitor email client activity.
   • CUse an application-based DLP plugin for the email client.
   • DEnable the cloud provider's native DLP service that scans email content and attachments, and blocks policy-violating messages.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is a key advantage of inline cloud-based DLP controls over API-based controls?

   • AInline controls are always cheaper than API-based controls.
   • BInline controls can block data transfers in real time as they occur.
   • CInline controls do not require any configuration or policy definitions.
   • DInline controls can only monitor data at rest.
   Reveal Solution Discussion Select an answer first