Data Loss Prevention (DLP) CSE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company uses a SaaS CRM and also has a custom application on Google Compute Engine (GCE). They want to implement DLP. The SaaS CRM has limited DLP features, while the GCE application is fully controlled by the company. Which approach is most effective?

   • AMove the GCE application to the SaaS CRM to simplify DLP.
   • BUse a CASB for the SaaS CRM and deploy a host-based DLP agent on the GCE instances.
   • CUse only the SaaS CRM's built-in DLP and apply the same policies to GCE.
   • DUse only network-based DLP for both environments.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company's DLP policy blocks the transfer of files containing source code to external cloud storage (e.g., Dropbox). An employee needs to share a source code file with an external contractor for a legitimate project. The employee attempts to share the file via a personal Gmail account, which is also blocked. The employee then compresses the file into a ZIP archive and tries to share it again. What is the most likely outcome?

   • AThe DLP solution allows the transfer because the ZIP archive is a different file type.
   • BThe DLP solution inspects the ZIP archive, detects the source code, and blocks the transfer.
   • CThe DLP solution blocks the transfer because the employee used a personal email account.
   • DThe DLP solution blocks the transfer because it recognizes the file type change as suspicious.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A financial institution uses a DLP solution that blocks emails containing credit card numbers. Recently, a legitimate email to a regulatory body was blocked, causing a delay. The compliance team wants to reduce false positives without weakening the protection. What should they do?

   • AIncrease the confidence threshold for detecting credit card numbers.
   • BRemove credit card numbers from the DLP policy.
   • CChange the DLP action from block to alert only.
   • DAdd the regulatory body's domain to an allow list in the DLP policy, while keeping the block action for other external recipients.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In a DLP policy, what is the role of 'actions'?

   • ATo specify the response when a policy rule is violated
   • BTo define what data is considered sensitive
   • CTo identify the users who can access the data
   • DTo encrypt data at rest in cloud storage
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company's DLP policy blocks the sharing of files containing 'Project X' (a codename) with external users. The policy uses exact data match (EDM) with a sensitive data table. An employee shares a file containing 'Project X' with an external partner, but the DLP policy does not trigger. What is the most likely reason?

   • AThe employee has been granted an exception to the DLP policy.
   • BThe sensitive data table has not been updated with the latest 'Project X' values, or the EDM matching threshold is too high.
   • CThe DLP policy is configured to only block sharing via email, not via external sharing links.
   • DThe file is encrypted, and the DLP solution cannot inspect encrypted content.
   Reveal Solution Discussion Select an answer first