A company's DLP system is not detecting data exfiltration via encrypted web traffic (HTTPS) to personal cloud storage. The network DLP sensor is placed at the internet gateway. Which architectural change would most likely improve detection?

Deploy endpoint DLP agents to inspect data before encryption

Disable HTTPS for all users to force plaintext traffic

Add more network DLP sensors at other gateway points

Move the network DLP sensor to a different network segment

A DLP policy is being created to protect financial data. The policy should detect when a spreadsheet containing a specific set of account numbers is emailed externally. Which combination of detection and response actions is most appropriate?

Use exact data matching for account numbers and block the email

Use document fingerprinting and quarantine the email

Use regular expression for account number pattern and encrypt the email

Use keyword matching for 'account' and allow with notification

A DLP team is deploying a policy to block outbound emails containing employee PII (social security numbers). The policy uses a regex for SSN format. During the pilot, the team sees a 40% false-positive rate because many non-sensitive numbers match the pattern. They also have a clean HR database of actual employee SSNs. Which change best reduces false positives without losing detection of real SSNs?

Add a second regex requiring dashes in the SSN format

Disable the policy and rely on manual review of all outbound email

Switch to exact data matching using the HR database as the source

Increase the confidence threshold for the regex

Which best practice helps reduce false positives in DLP deployments?

Starting with a pilot program and tuning policies based on feedback

Disabling alerts for all policy violations

Deploying DLP in blocking mode immediately

Using only keyword matching for detection

What is the first step in creating an effective DLP policy?

Configure the management console

Define data classification rules

EC-CouncilNetwork Defense Essentials

Domain 6Objective 5

Data Loss Prevention (DLP) Concepts NDE Practice Questions (Page 8)

Part of the Cryptography, PKI, and Data Security domain, which makes up ~15% of our current practice bank.

49questions here

10free pages

8concepts

Questions 36–40

36expert · hard
A company's DLP system is not detecting data exfiltration via encrypted web traffic (HTTPS) to personal cloud storage. The network DLP sensor is placed at the internet gateway. Which architectural change would most likely improve detection?
Select an answer first
37application · medium
A DLP policy is being created to protect financial data. The policy should detect when a spreadsheet containing a specific set of account numbers is emailed externally. Which combination of detection and response actions is most appropriate?
Select an answer first
38expert · hard
A DLP team is deploying a policy to block outbound emails containing employee PII (social security numbers). The policy uses a regex for SSN format. During the pilot, the team sees a 40% false-positive rate because many non-sensitive numbers match the pattern. They also have a clean HR database of actual employee SSNs. Which change best reduces false positives without losing detection of real SSNs?
Select an answer first
39foundation · easy
Which best practice helps reduce false positives in DLP deployments?
Select an answer first
40foundation · easy
What is the first step in creating an effective DLP policy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.