A company is implementing a DLP program for the first time. The compliance team wants to protect customer personal data (PII) across email, web, and endpoint channels. The security team needs to identify where sensitive data resides and how it flows. Which initial step should the DLP team take?

Deploy DLP agents to all endpoints and enable blocking on all sensitive data

Purchase a DLP solution and configure it to alert on all outbound traffic

Conduct a data discovery and classification exercise to identify sensitive data locations and flows

Create a DLP policy based on regulatory requirements and apply it to all channels

Which practice is a key component of mobile application security?

Disabling automatic app updates

Granting all requested permissions to ensure functionality

Reviewing app permissions before installation

Installing apps only from third-party app stores

A company's DLP solution flags an email containing a sensitive document as a policy violation. The email was sent from a corporate-owned smartphone using the native email app. The DLP administrator wants to determine if the mobile device is the source of the leak or if the document was already on the device. Which data should the administrator correlate to make this determination?

The device's GPS location at the time of the email

MDM device logs showing the document's download history and the DLP incident details

The user's email archive to see if the document was previously sent

The DLP policy rules to see if the document matched a fingerprint

A financial services firm needs to prevent customers' credit card numbers from being emailed externally. The DLP team is configuring a policy and must decide which detection technique to use. The firm has a database of known customer card numbers, but also wants to catch card numbers that are not in the database. Which detection technique should be the primary method in the DLP rule?

Keyword matching for the word 'credit card'

Machine learning classification based on historical email content

Regular expression pattern matching for card number format

Exact data matching against the customer database

A company is implementing a BYOD program. Employees will use personal smartphones to access corporate email and calendar. The security team wants to enforce a passcode, encrypt the device, and allow remote wipe of corporate data only. Which MDM approach best meets these requirements?

Full device management with corporate wipe capability

Email-only management that enforces passcode on the email app

Container-based management that separates corporate data and allows selective wipe

No management, relying on user awareness training

GIAC Security Essentials

Domain 6Objective 1

Data Loss Prevention and Mobile Device Security GSEC Practice Questions (Page 6)

Part of the Data Protection and Emerging Technologies domain, which makes up ~12% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~11–19 in this domain), expect 4–6 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 26–30

26application · medium
A company is implementing a DLP program for the first time. The compliance team wants to protect customer personal data (PII) across email, web, and endpoint channels. The security team needs to identify where sensitive data resides and how it flows. Which initial step should the DLP team take?
Select an answer first
27foundation · easy
Which practice is a key component of mobile application security?
Select an answer first
28expert · hard
A company's DLP solution flags an email containing a sensitive document as a policy violation. The email was sent from a corporate-owned smartphone using the native email app. The DLP administrator wants to determine if the mobile device is the source of the leak or if the document was already on the device. Which data should the administrator correlate to make this determination?
Select an answer first
29application · medium
A financial services firm needs to prevent customers' credit card numbers from being emailed externally. The DLP team is configuring a policy and must decide which detection technique to use. The firm has a database of known customer card numbers, but also wants to catch card numbers that are not in the database. Which detection technique should be the primary method in the DLP rule?
Select an answer first
30application · medium
A company is implementing a BYOD program. Employees will use personal smartphones to access corporate email and calendar. The security team wants to enforce a passcode, encrypt the device, and allow remote wipe of corporate data only. Which MDM approach best meets these requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GSEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GSEC” is a trademark of its owner, used for identification only.

Data Loss Prevention and Mobile Device Security GSEC Practice Questions (Page 6)

Questions 26–30

A company is implementing a DLP program for the first time. The compliance team wants to protect customer personal data (PII) across email, web, and endpoint channels. The security team needs to identify where sensitive data resides and how it flows. Which initial step should the DLP team take?

Which practice is a key component of mobile application security?

A company is implementing a BYOD program. Employees will use personal smartphones to access corporate email and calendar. The security team wants to enforce a passcode, encrypt the device, and allow remote wipe of corporate data only. Which MDM approach best meets these requirements?

Keep studying — Data Protection and Emerging Technologies