Which of the following would be of MOST concern to an IS auditor reviewing a data loss prevention (DLP) solution implementation for endpoints?

Question

Options

• AThe solution does not prevent data leakage because it is still in the monitoring phase.
• BThe organization has never finished tuning the solution.
• CThe DLP solution does not support all types of servers.
• DThe solution has been implemented in blocking mode prior to performing tuning.

• A
  12% (5)
• B
  19% (8)
• C
  5% (2)
• D
  65% (28)

Explanation

DLP solutions typically go through a monitoring (learning) phase before being switched to blocking mode. This tuning phase is critical for identifying false positives - legitimate business activities that the DLP rules would incorrectly block. Implementing a DLP solution in blocking mode before performing tuning (D) is the MOST concerning because it means legitimate business operations may be blocked without warning, causing operational disruption, and conversely, the rules may not yet be calibrated to catch actual data leakage accurately. Option A (still in monitoring phase) is normal and expected during initial deployment - monitoring mode is part of the proper implementation process, not a concern. Option B (never finishing tuning) is a concern but less severe than prematurely activating blocking mode. Option C (not supporting all server types) is a coverage gap but not as immediately harmful. Blocking mode before tuning inverts the proper implementation sequence and risks both operational disruption and false security confidence.

No community discussion yet for this question.