Data Loss Prevention and Mobile Device Security GSEC Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   When creating a DLP policy, what three types of conditions are commonly used to define rules?

   • AContent, context, and user behavior
   • BOperating system, patch level, and installed software
   • CEncryption algorithm, key length, and hash function
   • DSource IP, destination IP, and port number
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A DLP administrator is configuring a policy to detect source code exfiltration. The source code contains unique identifiers and proprietary function names. The administrator wants to detect both exact copies and modified versions of the code. Which detection technique is most appropriate?

   • AKeyword matching for proprietary function names
   • BFingerprinting (document matching) that creates a hash of the code and detects partial matches
   • CMachine learning classification of code-like content
   • DExact data matching against the source code repository
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A DLP administrator is configuring a policy for a law firm that handles highly confidential client documents. The policy currently blocks any email containing a document fingerprint match. However, the firm's attorneys frequently send redacted versions of these documents to opposing counsel. The redacted documents still trigger the fingerprint match because the fingerprinting algorithm is based on the entire document. What should the administrator do to allow legitimate redacted documents while still blocking full documents?

   • AIncrease the sensitivity of the fingerprinting algorithm to reduce false positives
   • BDisable fingerprinting and use keyword matching for 'confidential'
   • CCreate a separate rule that allows emails with a specific subject line and a justification from the sender
   • DChange the fingerprinting algorithm to only match the first page of the document
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is the primary purpose of a Data Loss Prevention (DLP) system?

   • ATo detect and prevent unauthorized access, use, or exfiltration of sensitive data
   • BTo provide real-time antivirus and malware protection on endpoints
   • CTo encrypt all data at rest and in transit across the enterprise
   • DTo manage user identities and access permissions across applications
   Reveal Solution Discussion Select an answer first
6. 50foundation · easy

   What is a key difference between BYOD and COPE strategies?

   • ABYOD devices cannot access corporate email
   • BCOPE devices are not managed by the organization
   • CBYOD uses employee-owned devices, while COPE uses company-owned devices that employees can use personally
   • DBYOD devices are always more secure than COPE devices
   Reveal Solution Discussion Select an answer first