A DLP administrator configures a policy that blocks outbound emails containing credit card numbers. During a pilot, a finance user's legitimate invoice email is blocked because a customer's reference number looks like a card number. What is the most appropriate immediate remediation step?

Release the email and add the customer reference pattern to an exception list

Notify the user and allow the email to proceed without logging

Quarantine the email and require the user to resend it manually

Disable the policy to avoid further business interruption

A DLP alert fires when a user attempts to copy a customer database to a USB drive. The policy is set to 'block with notification'. The user claims the file was needed for a legitimate offline analysis. What is the most appropriate next step in the incident response workflow?

Immediately terminate the user's access

Change the policy to allow USB transfers for all users

Ignore the alert because the block was successful

Review the incident details and determine if the user has a business justification

A DLP administrator is creating a policy to protect sensitive documents that are stored in a shared network drive. The documents are not consistently labeled, and the administrator wants to detect them based on their content. The policy must minimize false positives. Which detection method should be used?

Contextual analysis based on file location

Regular expression matching for SSN patterns

Keyword matching for common terms like 'confidential'

Document fingerprinting of known sensitive files

EC-CouncilNetwork Defense Essentials

Domain 6Objective 5

Data Loss Prevention (DLP) Concepts NDE Practice Questions (Page 5)

Part of the Cryptography, PKI, and Data Security domain, which makes up ~15% of our current practice bank.

49questions here

10free pages

8concepts

Questions 21–25

21application · medium
A DLP administrator configures a policy that blocks outbound emails containing credit card numbers. During a pilot, a finance user's legitimate invoice email is blocked because a customer's reference number looks like a card number. What is the most appropriate immediate remediation step?
Select an answer first
22application · medium
A DLP alert fires when a user attempts to copy a customer database to a USB drive. The policy is set to 'block with notification'. The user claims the file was needed for a legitimate offline analysis. What is the most appropriate next step in the incident response workflow?
Select an answer first
23expert · hard
A DLP administrator is creating a policy to protect sensitive documents that are stored in a shared network drive. The documents are not consistently labeled, and the administrator wants to detect them based on their content. The policy must minimize false positives. Which detection method should be used?
Select an answer first
24foundation · easy
Which DLP deployment mode is most appropriate for protecting data stored in cloud applications like Office 365 or Google Drive?
Select an answer first
25foundation · easy
What is the typical first action in a DLP incident response workflow when a policy violation is detected?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.

Data Loss Prevention (DLP) Concepts NDE Practice Questions (Page 5)

Questions 21–25

A DLP administrator configures a policy that blocks outbound emails containing credit card numbers. During a pilot, a finance user's legitimate invoice email is blocked because a customer's reference number looks like a card number. What is the most appropriate immediate remediation step?

A DLP alert fires when a user attempts to copy a customer database to a USB drive. The policy is set to 'block with notification'. The user claims the file was needed for a legitimate offline analysis. What is the most appropriate next step in the incident response workflow?

Which DLP deployment mode is most appropriate for protecting data stored in cloud applications like Office 365 or Google Drive?

What is the typical first action in a DLP incident response workflow when a policy violation is detected?

Keep studying — Cryptography, PKI, and Data Security