Data Loss Prevention (DLP) CSE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A DLP administrator is creating a policy to protect intellectual property stored in Google Drive. They need to define what data is sensitive, what conditions trigger a violation, and what happens when a violation occurs. Which set of components must the policy include?

   • ALogs, alerts, and dashboards.
   • BEncryption keys, certificates, and hashing algorithms.
   • CUser roles, IP addresses, and time of day.
   • DData classification, rules/conditions, and actions.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is migrating from an on-premises file server to Amazon S3. The security team needs to identify which objects in the S3 buckets contain personally identifiable information (PII) before applying DLP controls. The company uses AWS Organizations with multiple accounts and has enabled AWS CloudTrail. What is the most efficient way to discover and classify PII across all S3 buckets?

   • AEnable S3 server access logging and analyze the logs for GET requests to identify sensitive data.
   • BManually review the S3 bucket names and object keys to identify likely PII locations.
   • CUse Amazon Macie with automated data discovery to scan all buckets in the organization and generate a sensitivity inventory.
   • DUse AWS Config rules to check for buckets that are publicly accessible, assuming those contain PII.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of DLP monitoring and reporting?

   • ATo automatically patch vulnerabilities in cloud applications
   • BTo manage user access permissions in real time
   • CTo replace the need for encryption in the cloud
   • DTo provide visibility into data activity and support compliance and incident response
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company uses a cloud access security broker (CASB) with DLP capabilities for its SaaS applications. The compliance team needs to generate a report showing all attempts to share files containing credit card numbers externally over the past quarter. The report must include the user, the file name, the external recipient, and the action taken by the DLP policy. What should the administrator do to produce this report?

   • ARun a CloudTrail query to find S3 bucket policy changes that allowed external sharing.
   • BReview the SaaS application's native audit log for file-sharing events.
   • CUse the DLP policy's real-time alert feed and manually compile incidents as they occur.
   • DQuery the CASB's DLP incident log and export the relevant fields to a CSV for the compliance team.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company uses a SaaS HR application and also runs a custom application on AWS EC2. They want to enforce DLP across both environments. The SaaS provider offers limited DLP capabilities, while the EC2 application has full control. Which strategy best addresses this mixed environment?

   • AMove the EC2 application to the SaaS platform to simplify DLP.
   • BUse a CASB to augment DLP for the SaaS app and deploy a network-based DLP or host-based agent for the EC2 application.
   • CUse only network-level DLP for both environments.
   • DRely solely on the SaaS provider's DLP and apply the same policies to EC2.
   Reveal Solution Discussion Select an answer first