Which of the following is the BEST course of action to prevent false positives from data loss prevention (DLP) tools?

The correct answer is D. Re-establish baselines tor configuration rules. False positives in DLP tools occur when legitimate activities are incorrectly flagged as policy violations. The root cause is typically misconfigured or poorly tuned detection rules. Re-establishing baselines for configuration rules (D) directly addresses this by recalibrating wh

Privacy Architecture

Question

Options

AConduct additional discovery scans.
BSuppress the alerts generating the false positives.
CEvaluate new data loss prevention (DLP) tools.
DRe-establish baselines tor configuration rules

How the community answered

(47 responses)

A
6% (3)
B
11% (5)
C
2% (1)
D
81% (38)

Explanation

False positives in DLP tools occur when legitimate activities are incorrectly flagged as policy violations. The root cause is typically misconfigured or poorly tuned detection rules. Re-establishing baselines for configuration rules (D) directly addresses this by recalibrating what the DLP tool considers 'normal' behavior, reducing incorrect alerts. Suppressing alerts (B) is dangerous because it hides real incidents along with false ones. Conducting additional discovery scans (A) identifies data but does not fix the tuning problem. Evaluating new DLP tools (C) is a costly, disruptive last resort that does not address the underlying configuration issue.

Topics

#DLP (Data Loss Prevention)#False Positives#Configuration Baselines#Privacy Tool Management

Community Discussion

No community discussion yet for this question.

Full CDPSE Practice