A DLP incident is detected when an employee attempts to upload a file containing customer PII to a personal webmail account. The DLP system blocks the upload and generates an alert. According to best practices, what should the incident response workflow include next?

Automatically terminate the employee's access

Ignore the incident if the upload was blocked

Quarantine the file and delete it permanently

Notify the employee and log the incident for review

A hospital is implementing DLP to protect PHI. The DLP team is concerned about alert fatigue and user privacy. They want to ensure that only actual PHI is flagged and that monitoring is limited to necessary systems. Which combination of practices best addresses both concerns?

Use content inspection with a PHI dictionary and deploy endpoint DLP only on clinical workstations

Monitor all network traffic and all endpoints to ensure complete coverage

Use only contextual analysis based on sender and recipient roles

Deploy network DLP only and avoid endpoint monitoring

An organization needs to detect when employees send emails containing credit card numbers. The credit card numbers are stored in a CRM system. Which DLP detection technique is most appropriate for this scenario?

Document fingerprinting of CRM records

Exact data matching against the CRM database

Contextual analysis based on email subject

Keyword matching for 'credit card'

A multinational company must protect intellectual property (source code) while respecting employee privacy laws that restrict monitoring of personal communications. Which DLP approach best balances both requirements?

Deploy endpoint DLP that monitors only corporate repositories and development tools

Monitor all employee email and instant messaging without exception

Rely on user training and accept the risk of IP leakage

Use network DLP to inspect all traffic, including personal webmail

A DLP administrator is configuring a policy to block emails containing social security numbers. The policy is generating a high number of false positives because many emails contain numbers that match the SSN pattern but are not actual SSNs. The administrator wants to reduce false positives while still detecting real SSNs. Which approach is most effective?

Use regular expression with checksum validation

Use exact data matching against a list of employee SSNs

Use a combination of exact data matching and contextual analysis

Use contextual analysis to require the presence of 'SSN' or 'Social Security' nearby

EC-CouncilNetwork Defense Essentials

Domain 6Objective 5

Data Loss Prevention (DLP) Concepts NDE Practice Questions (Page 9)

Part of the Cryptography, PKI, and Data Security domain, which makes up ~15% of our current practice bank.

49questions here

10free pages

8concepts

Questions 41–45

41application · medium
A DLP incident is detected when an employee attempts to upload a file containing customer PII to a personal webmail account. The DLP system blocks the upload and generates an alert. According to best practices, what should the incident response workflow include next?
Select an answer first
42expert · hard
A hospital is implementing DLP to protect PHI. The DLP team is concerned about alert fatigue and user privacy. They want to ensure that only actual PHI is flagged and that monitoring is limited to necessary systems. Which combination of practices best addresses both concerns?
Select an answer first
43application · medium
An organization needs to detect when employees send emails containing credit card numbers. The credit card numbers are stored in a CRM system. Which DLP detection technique is most appropriate for this scenario?
Select an answer first
44application · medium
A multinational company must protect intellectual property (source code) while respecting employee privacy laws that restrict monitoring of personal communications. Which DLP approach best balances both requirements?
Select an answer first
45expert · hard
A DLP administrator is configuring a policy to block emails containing social security numbers. The policy is generating a high number of false positives because many emails contain numbers that match the SSN pattern but are not actual SSNs. The administrator wants to reduce false positives while still detecting real SSNs. Which approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.