Matt, a security analyst, needs to implement encryption for company data and also prevent theft of company data. Where and how should Matt meet this requirement?

Access control lists restrict who can access resources and EFS encrypts individual files, but neither provides the active data-theft prevention capability that DLP offers.

DLP monitors and controls data flows to prevent unauthorized transfer or exfiltration of sensitive data, directly addressing the theft prevention requirement. Encrypting the company database ensures that even if data is accessed without authorization, it remains unreadable - together these two controls satisfy both the encryption and theft-prevention requirements.

TrueCrypt (volume encryption) protects data at rest on a server volume but does not actively monitor or prevent data from being exfiltrated, leaving the theft-prevention requirement unmet.

TPMs secure cryptographic keys at the hardware level and do not directly encrypt a database or prevent data theft through exfiltration channels.