Cisco Certified Support Technician (CCST) CybersecurityEndpoint SecurityMedium
A security engineer is designing an endpoint security strategy for a highly regulated financial institution. A critical requirement is to prevent sensitive customer data, such as credit card numbers and social security numbers, from being copied to USB drives, sent via unencrypted email, or uploaded to unauthorized cloud storage services from any corporate endpoint. Which endpoint security technology is specifically designed to enforce these data handling policies?
- AAntivirus/Anti-malware
- BNetwork Access Control (NAC)
- CData Loss Prevention (DLP)
- DEndpoint Detection and Response (EDR)
Show answer & explanationAnswer & explanation
Correct answer: C. Data Loss Prevention (DLP)
Data Loss Prevention (DLP) solutions are specifically designed to prevent sensitive data from leaving an organization's control. They identify, monitor, and protect data in use, in motion, and at rest, and can block actions like copying sensitive files to USB, sending them via unauthorized email, or uploading them to unapproved cloud services.
Why the other options are wrong
- A. Antivirus/Anti-malware protects against malicious software, not against authorized users misusing sensitive data.
- B. NAC controls network access for devices, not the movement of sensitive data from within an endpoint.
- D. EDR focuses on detecting and responding to threats, not preventing sensitive data exfiltration.
Data Loss Prevention (DLP)
A set of tools and processes used to ensure that sensitive data is not lost, misused, or accessed by unauthorized users. DLP solutions classify data, monitor its movement, and prevent unauthorized data transfers.
- Protects sensitive data from exfiltration (leaving the organization).
- Monitors data in use, in motion, and at rest.
- Can block or alert on specific actions like copying to USB, emailing, or uploading.
Memory trick: DLP is like a vigilant guard, making sure no sensitive documents leave the building without permission.