The BEST way to protect against the internal threat of sensitive data disclosure is to implement?

Question

Options

• Aan intrusion detection system (IDS)
• Ba data classification policy
• Ca data loss prevention (DLP) solution
• Da data governance policy

• A
  2% (1)
• B
  2% (1)
• C
  89% (40)
• D
  7% (3)

Explanation

A Data Loss Prevention (DLP) solution directly addresses the internal threat of sensitive data disclosure by actively monitoring, detecting, and blocking unauthorized transfers or exfiltration of sensitive data - whether via email, USB, cloud uploads, or other channels. An IDS (A) monitors for network intrusions and suspicious activity but does not prevent data from leaving the organization. A data classification policy (B) labels data by sensitivity level, which is a prerequisite for protection but doesn't enforce controls on its own. A data governance policy (D) defines rules and accountability around data management but, like classification, is a policy framework rather than a technical control that stops exfiltration.

Memory tip: Think "DLP = Data Leakage Prevention" - it's the only option that actively stops data from walking out the door, making it the best fit for the word "protect" in the question. When you see "internal threat" + "disclosure" on an exam, DLP is almost always the technical answer; policies support it but don't enforce it.

No community discussion yet for this question.