SY0-501 · Question #399
A security administrator learns that PII, which was gathered by the organization, has been found in an open forum. As a result, several C-level executives found their identities were compromised…
The correct answer is B. Implement an email DLP. C. Implement a spam filter. This question addresses preventing PII data leakage and whaling (spear-phishing targeting executives) attacks. Two complementary controls are needed: one to stop data exfiltration and one to block malicious emails.
Question
A security administrator learns that PII, which was gathered by the organization, has been found in an open forum. As a result, several C-level executives found their identities were compromised, and they were victims of a recent whaling attack. Which of the following would prevent these problems in the future? (Select TWO).
Options
- AImplement a reverse proxy.
- BImplement an email DLP.
- CImplement a spam filter.
- DImplement a host-based firewall.
- EImplement a HIDS.
How the community answered
(64 responses)- A11% (7)
- B83% (53)
- D2% (1)
- E5% (3)
Why each option
This question addresses preventing PII data leakage and whaling (spear-phishing targeting executives) attacks. Two complementary controls are needed: one to stop data exfiltration and one to block malicious emails.
A reverse proxy protects web servers by intermediating inbound requests from external clients, but it does not inspect email content for PII exfiltration or block phishing/whaling email attacks.
Email Data Loss Prevention (DLP) inspects outbound email content for sensitive data patterns such as PII, and can block or quarantine messages before they leave the organization, directly preventing PII from being exposed in open forums through email channels.
A spam filter analyzes inbound emails for phishing indicators, spoofed domains, and malicious content, and can detect and block whaling/spear-phishing emails targeting executives before they reach the inbox, mitigating the social engineering attack vector.
A host-based firewall controls network traffic to and from a specific host based on port and protocol rules, but it does not inspect email content for sensitive data or filter phishing messages targeting executives.
A Host-based Intrusion Detection System (HIDS) monitors a host for suspicious activity and policy violations after the fact, but it does not proactively prevent PII from being sent via email or block inbound whaling emails before they are delivered.
Concept tested: Preventing PII exfiltration and whaling email attacks
Source: https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-learn-about-dlp?view=o365-worldwide
Topics
Community Discussion
No community discussion yet for this question.