Cisco CCNP Security Core (SCOR) 350-701Content SecurityMedium
A security auditor recommends implementing a content security solution that can prevent sensitive data from leaving the network via email, web uploads, and endpoint devices simultaneously. The solution must also provide detailed reporting on data movement and policy violations. Which content security technology offers this comprehensive, multi-channel data protection and visibility?
- ANext-Generation Firewall (NGFW)
- BIntrusion Prevention System (IPS)
- CEnterprise Data Loss Prevention (DLP)
- DSecurity Information and Event Management (SIEM)
Show answer & explanationAnswer & explanation
Correct answer: C. Enterprise Data Loss Prevention (DLP)
Enterprise Data Loss Prevention (DLP) solutions are designed to protect sensitive data across multiple egress channels (email, web, endpoints). They identify, monitor, and prevent unauthorized data transfers and provide comprehensive logging and reporting on policy violations.
Why the other options are wrong
- A. An NGFW provides application control, IPS, and URL filtering, but its DLP capabilities are often limited compared to a dedicated enterprise DLP solution and may not cover endpoints comprehensively.
- B. An IPS primarily focuses on detecting and preventing network-based attacks and does not inherently offer multi-channel sensitive data protection and reporting.
- D. A SIEM aggregates logs and events for analysis and reporting, but it doesn't actively prevent data loss across multiple channels; it's a monitoring and correlation tool.
Enterprise DLP
A comprehensive data loss prevention solution that protects sensitive information across network, endpoint, and cloud environments.
- Covers data in motion, at rest, and in use.
- Enforces policies across multiple channels (email, web, USB).
- Provides granular reporting and incident response capabilities.
Memory trick: DLP guards all data exits.