Data Loss Prevention (DLP) Concepts NDE Practice Questions (Page 10)

Questions 46–49

1. 46expert · hard

   A DLP administrator is configuring a policy for a new regulation that requires blocking the transmission of customer financial data. The policy is set to 'block' mode, but during the first week, several legitimate business emails are blocked, causing customer complaints. The administrator needs to reduce business disruption while still meeting the regulation. Which approach is most balanced?

   • ADisable the policy until the regulation is clarified
   • BKeep the policy in 'block' mode and tell users to avoid sending financial data
   • CChange the policy to 'notify only' and rely on user training
   • DSet the policy to 'quarantine' for a review period, then move to 'block' after tuning
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A DLP administrator is facing resistance from employees who feel that monitoring their emails and file transfers violates their privacy. The company has a legitimate need to protect sensitive data. Which approach best addresses employee privacy concerns while maintaining effective DLP?

   • AOnly monitor executives and IT staff
   • BImplement DLP policies that focus on data classification and only monitor content that is classified as sensitive
   • CDisable DLP monitoring and rely on user training
   • DMonitor all employee communications without exception
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A healthcare organization wants to detect when patient records are being copied to USB drives. The records are stored in a custom database and exported as PDFs with a consistent header format. Which detection technique would yield the fewest false positives while reliably identifying these specific records?

   • AKeyword matching for 'Patient Record'
   • BRegular expression matching for dates and names
   • CExact data matching against a database of patient IDs
   • DDocument fingerprinting of the PDF templates
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A DLP incident is detected when a user attempts to send a file containing PHI to a personal email address. The DLP system blocks the email and quarantines the file. The user claims it was a mistake. What is the most appropriate next step in the incident response workflow?

   • ARestore the email and allow the user to send it
   • BEscalate the incident to law enforcement
   • CPermanently delete the quarantined file
   • DNotify the user and provide training on data handling policies
   Reveal Solution Discussion Select an answer first