An audit reveals that files containing customer account numbers were uploaded months ago to the organization's sanctioned cloud storage tenant. Security must find those files that are already stored there, not only future uploads. Which Cisco Secure Access DLP capability addresses this?
Select an answer to reveal the explanation.
Short Explanation
Inline DLP is a guard at the door: it only sees what walks through from now on. Files that walked in months ago are already inside, so you need something that goes into the tenant and looks around, and that's the API-based SaaS rule. Don't fall for the real-time rule here; it can't see the past.
Full Explanation
Cisco Secure Access offers two complementary DLP approaches. Real-time rules sit inline on web proxy traffic and evaluate content as it moves. SaaS API rules connect to a sanctioned cloud tenant through that provider's APIs and scan files stored there for data that matches the selected data classifications, including files that were uploaded long before the rule existed, and they keep assessing files as they change. That out-of-band, at-rest inspection is what the requirement calls for. A real-time rule inspects only traffic that passes through the gateway after it is enabled, so historical uploads are never seen. Blocking the storage provider's domains in DNS policy stops access to a sanctioned service without finding or remediating a single file. AI guardrails rules inspect prompts and responses exchanged with generative AI applications; they do not scan file stores. Exam caveat: the API approach depends on authorizing Secure Access against the tenant, and it acts after the fact rather than preventing the upload. Operational check: confirm that the tenant is authorized in Secure Access, run the rule or a discovery scan against it, and verify that the known test file containing account numbers produces a DLP event.