Data Loss Prevention (DLP) CSE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company uses a DLP solution that integrates with its identity provider (IdP). The DLP policy blocks sharing of files containing source code with external users. An employee's account is compromised, and the attacker attempts to share a source code file externally. The DLP policy blocks the sharing action. However, the attacker also downloads the file to a personal device. What is the most significant limitation of the DLP control in this scenario?

   • ADLP cannot detect that the account is compromised because it relies on the IdP for authentication, not behavioral analysis.
   • BDLP cannot encrypt the file after it is downloaded, so the attacker can read it.
   • CDLP cannot block the download because the file is not classified as sensitive by the policy.
   • DDLP cannot prevent data exfiltration that occurs through legitimate user actions like downloading a file to a personal device.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which DLP enforcement technique prevents a user from sending a sensitive file via email?

   • AQuarantine
   • BEncryption
   • CAuditing
   • DBlocking
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company uses both Office 365 and AWS S3. They want to discover sensitive data across both environments and apply consistent DLP policies. Which approach best achieves this?

   • AUse a CASB that supports both Office 365 and AWS S3, with built-in DLP capabilities.
   • BUse AWS Macie for both environments.
   • CUse separate DLP tools for each environment and manually correlate findings.
   • DMove all data to Office 365 to simplify DLP.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A software company uses a PaaS platform (e.g., Azure App Service) to host a customer portal. The application stores customer data in a managed database and allows users to upload documents. The company needs to implement DLP to prevent customers from uploading files containing credit card numbers. What is the most appropriate DLP approach for this PaaS environment?

   • AUse a CASB to inspect all data in the PaaS application's database.
   • BConfigure the PaaS platform's built-in WAF to block uploads containing credit card numbers.
   • CDeploy a network-based DLP appliance in a VNet to inspect all traffic to the PaaS application.
   • DUse a cloud DLP API (e.g., Google Cloud DLP or Amazon Macie) to inspect uploaded files as part of the application's upload workflow.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company uses a hybrid cloud environment with data stored in both on-premises file servers and Azure Blob Storage. The security team needs to classify data across both environments to identify sensitive data for DLP policy development. What is the most efficient approach?

   • AUse Azure Information Protection (AIP) to scan only Azure Blob Storage.
   • BUse a third-party DLP tool that only scans cloud storage.
   • CUse manual classification by data owners for both environments.
   • DUse Microsoft Purview to scan both on-premises and Azure Blob Storage data sources.
   Reveal Solution Discussion Select an answer first