Which of the following would be of MOST concern to an IS auditor reviewing a data loss prevention (DLP) solution implementation for endpoints?

Question

Options

• AThe DLP solution does not support all types of servers.
• BThe solution has been implemented in blocking mode prior to performing tuning.
• CThe organization has never finished tuning the solution.
• DThe solution does not prevent data leakage because it is still in the monitoring phase.

• A
  5% (1)
• B
  14% (3)
• C
  77% (17)
• D
  5% (1)

Explanation

A DLP solution that has never been fully tuned is the greatest concern because it indicates a permanent state of ineffectiveness. Untuned DLP solutions typically generate excessive false positives (causing alert fatigue and ignored alerts) or miss actual data leakage events - meaning the tool provides little real protection despite being deployed. Starting in blocking mode before tuning (B) is risky but temporary. Operating in monitoring mode (D) is an intentional phase of implementation and is expected. Not supporting all server types (A) is a gap but limited in scope. Never completing tuning means the organization has a false sense of security with a DLP tool that is not actually performing its function.

No community discussion yet for this question.