Data Loss Prevention (DLP) CSE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which method is commonly used to discover sensitive data in cloud storage?

   • AAnalyzing CPU usage of cloud virtual machines
   • BReviewing network firewall logs for unusual traffic
   • CChecking the version of the operating system on cloud servers
   • DScanning storage buckets and repositories for patterns such as credit card numbers or social security numbers
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company is migrating from on-premises file servers to AWS S3. They need to identify where sensitive data such as credit card numbers resides in their S3 buckets before implementing DLP. They also want to automatically tag the sensitive objects for future policy enforcement. Which approach should they use?

   • AUse AWS Config rules to check for objects with the 'credit-card' prefix.
   • BApply a bucket policy that denies access to any object containing credit card numbers.
   • CEnable S3 server access logging and manually review the logs for sensitive data.
   • DUse Amazon Macie to scan S3 buckets, classify sensitive data, and apply custom tags to the findings.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A DLP administrator needs to generate a monthly report for auditors showing the number of policy violations, the types of data involved, and the actions taken. Which DLP feature should they use?

   • AThe SIEM's raw logs without any filtering.
   • BThe cloud provider's billing dashboard.
   • CThe DLP policy configuration page.
   • DThe DLP solution's reporting and dashboard module.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   How do DLP reports support incident response?

   • ABy providing detailed logs of data access and policy violations that can be used to investigate and remediate incidents
   • BBy automatically deleting compromised data
   • CBy blocking all network traffic during an incident
   • DBy resetting user passwords after a security incident
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A multinational corporation uses Microsoft 365 and has a DLP policy that blocks external sharing of documents containing personally identifiable information (PII). The policy is working, but the security team wants to reduce false positives and improve incident response. They plan to integrate DLP with Microsoft Defender for Cloud Apps (CASB) and Microsoft Sentinel. What is the primary benefit of this integration?

   • AThe integration allows DLP to block all data transfers to any external IP address, eliminating the need for user training.
   • BThe CASB can apply DLP policies to third-party SaaS apps beyond Microsoft 365, and Sentinel can correlate DLP alerts with other security events for investigation.
   • CThe integration enables DLP to encrypt all files containing PII automatically, making them unreadable to authorized users.
   • DThe CASB replaces the need for DLP policies in Microsoft 365, and Sentinel automatically remediates all DLP violations.
   Reveal Solution Discussion Select an answer first