Data Loss Prevention (DLP) CSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A healthcare organization uses Microsoft 365 and has a DLP policy that blocks external sharing of documents containing patient health information (PHI). A researcher needs to share a de-identified dataset (no PHI) with an external collaborator but the file is being blocked because the DLP policy uses a broad keyword match that flags the word 'patient' in the dataset's column headers. The organization wants to maintain the current protection level for actual PHI while enabling this legitimate sharing. What should the administrator do?

   • ACreate a new DLP rule with a higher priority that exempts files tagged with a custom 'De-identified' sensitivity label, and apply that label to the dataset.
   • BAdd the external collaborator's domain to the DLP policy's allowed domains list.
   • CTemporarily disable the DLP policy, share the file, and re-enable the policy afterward.
   • DRemove the word 'patient' from the DLP policy's keyword dictionary.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A university uses a mix of on-premises storage and Microsoft 365 (Exchange Online, SharePoint, OneDrive). The IT team needs to discover where student records (containing social security numbers) are stored across both environments to build a data inventory for a DLP initiative. What is the most effective approach?

   • AUse Microsoft Purview Data Map for the cloud data and a network share scanner for on-premises file servers, then combine the results.
   • BUse only Microsoft Purview Data Map to scan both on-premises and cloud data.
   • CUse Microsoft Defender for Cloud Apps to scan on-premises file shares for sensitive data.
   • DUse a manual survey of all departments to identify where student records are stored.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How does a CASB (Cloud Access Security Broker) complement a DLP solution?

   • ABy managing user identities and access permissions
   • BBy providing DLP policies that replace the need for any other security controls
   • CBy providing visibility and control over sanctioned and unsanctioned cloud applications, which DLP can use to enforce data protection policies
   • DBy encrypting all data at rest in cloud storage
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is implementing a DLP program and wants to ensure it aligns with its existing security controls, including IAM and encryption. The security architect needs to explain to management how DLP complements these controls. Which statement best describes the relationship?

   • ADLP replaces the need for IAM and encryption because it can block all unauthorized access.
   • BDLP is only effective when IAM and encryption are not in place, because they interfere with content inspection.
   • CDLP is a subset of IAM, as it controls which users can access sensitive data.
   • DDLP focuses on data in use, in motion, and at rest, while IAM controls who can access data and encryption protects data from unauthorized access.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An organization uses a CASB to monitor a SaaS application. They want to block uploads of files containing PII to the SaaS app, but they also need to allow legitimate business uploads that have been approved by the data owner. Which CASB feature should they configure?

   • AA policy that alerts on uploads but does not block them.
   • BA DLP policy with an exception for files that have a specific sensitivity label or are approved by the data owner.
   • CA policy that encrypts all uploads before they reach the SaaS app.
   • DA policy that blocks all uploads to the SaaS app.
   Reveal Solution Discussion Select an answer first