Data Loss Prevention (DLP) CSE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A financial services firm runs a custom application on Amazon EC2 instances that processes customer financial data. The application writes sensitive data to an Amazon RDS database and also generates CSV exports that are stored in S3. The firm's DLP requirements include blocking unauthorized access to the data and preventing data exfiltration. The security architect must choose a DLP approach that provides content-level inspection and enforcement without requiring application code changes. Which approach best meets these requirements?

   • AConfigure an S3 bucket policy to deny public access and rely on IAM roles for access control.
   • BEnable RDS encryption and S3 server-side encryption to protect data at rest.
   • CDeploy a cloud-native DLP agent on the EC2 instances and configure it to monitor file system activity and network egress, with blocking actions on policy violations.
   • DUse AWS Network Firewall to inspect all traffic and block sensitive data transfers.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In which cloud service model does the customer have the most responsibility for implementing DLP controls?

   • AOn-premises
   • BSaaS
   • CPaaS
   • DIaaS
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A multi-national company uses Google Workspace and AWS. They need to discover sensitive data in both environments, but they have strict data residency requirements that prohibit sending data to certain regions for scanning. Which approach should they take?

   • ADeploy DLP tools that support regional data residency, such as Google DLP with regional endpoints and AWS Macie with regional scanning, ensuring data stays within allowed regions.
   • BSkip DLP scanning and rely on manual classification.
   • CUse a single CASB that processes all data in a central location.
   • DManually export data to a central repository for scanning.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst needs to investigate a potential DLP violation that occurred last week. The DLP solution logs all incidents and integrates with the SIEM. Which step should the analyst take first?

   • ASearch the SIEM for DLP alerts and related user activity from the time of the incident.
   • BCheck the user's email for any related communications.
   • CContact the cloud provider for network logs.
   • DReview the DLP policy to see if it was correctly configured.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company uses Azure Blob Storage and wants to automatically discover sensitive data such as healthcare records. They also want to apply sensitivity labels to the discovered data for future DLP enforcement. Which Azure service should they use?

   • AMicrosoft Purview (formerly Azure Purview) for data discovery and classification.
   • BAzure Security Center for vulnerability scanning.
   • CAzure Monitor for log analytics.
   • DAzure Policy for compliance auditing.
   Reveal Solution Discussion Select an answer first