Data Loss Prevention (DLP) CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company uses Salesforce (SaaS) to manage customer relationships and stores customer data in the platform. The security team needs to discover if any customer records contain credit card numbers to comply with PCI DSS. What is the most effective way to discover this data in Salesforce?

   • AExport all Salesforce data to a data lake and use a cloud DLP service to scan it.
   • BUse Salesforce's built-in encryption feature to identify credit card numbers.
   • CUse a CASB with DLP capabilities that can scan Salesforce records for credit card numbers.
   • DUse Salesforce's native audit log to identify records that contain credit card numbers.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company runs a containerized application on Amazon EKS (Kubernetes) that processes financial data. The application stores data in Amazon S3 and also sends data to a third-party analytics service via API. The security team needs to implement DLP to prevent sensitive data from being sent to the third-party service. The team cannot modify the application code. What is the most effective DLP approach?

   • ADeploy a DLP agent as a sidecar container in the Kubernetes pods to inspect outbound API traffic.
   • BUse AWS Network Firewall to inspect all traffic from the EKS cluster.
   • CUse Amazon Macie to scan S3 objects and block access to sensitive data.
   • DUse an S3 bucket policy to block access to the third-party service's IP addresses.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company uses a DLP solution that classifies data into three categories: Public, Internal, and Confidential. The DLP policy for Confidential data blocks external sharing and requires encryption for email attachments. An employee attempts to email a Confidential document to a personal email address. What should the DLP policy do?

   • AQuarantine the email for review by the security team.
   • BBlock the email and notify the employee that the action violates the DLP policy.
   • CEncrypt the email and allow it to be sent to the personal email address.
   • DAllow the email but log the event for compliance reporting.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's DLP solution is integrated with its SIEM. The security team wants to create a dashboard that shows the number of DLP incidents by severity, data type, and department over the past month. What is the most efficient way to build this dashboard?

   • AUse the DLP solution's built-in reporting feature to generate a static PDF report.
   • BUse a separate BI tool to connect directly to the DLP solution's database.
   • CExport DLP incidents to a spreadsheet and create a pivot table manually.
   • DUse the SIEM's dashboarding capabilities to query DLP incident data and create visualizations.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An organization uses a SaaS application (Salesforce) and a CASB to monitor user activity. They want to prevent users from downloading customer records with PII to unmanaged personal devices, but they still need to allow access from managed corporate devices. What is the most effective way to enforce this?

   • AUse Salesforce's built-in DLP to encrypt all PII fields.
   • BDisable the download feature in Salesforce for all users.
   • CConfigure the CASB to block downloads of files containing PII when the device is not managed, while allowing downloads on managed devices.
   • DRequire multi-factor authentication for all Salesforce logins.
   Reveal Solution Discussion Select an answer first