A database server uploads several gigabytes each night to a personal account on a public cloud storage service that the company does not use. The traffic is HTTPS to a reputable provider. Which control best detects and prevents this exfiltration path?
Select an answer to reveal the explanation.
Short Explanation
The destination is a big-name cloud provider, so reputation filters won't flinch. You need something that knows which cloud apps are sanctioned, what's being uploaded, and to whose account. That's a CASB with DLP, and it sees what a plain firewall waves through.
Full Explanation
Cloud storage exfiltration abuses legitimate, reputable services, so reputation-based blocking does not help and the traffic blends into normal HTTPS. A cloud access security broker discovers and controls cloud application use, distinguishing sanctioned from unsanctioned applications and, in many designs, corporate from personal instances. Combined with data loss prevention, it can inspect uploads for sensitive content and block or alert on transfers to unsanctioned destinations. In Cisco Secure Access these capabilities are part of Secure Internet Access, alongside decryption that allows content inspection. An IPS signature keyed on the provider's TLS certificate would block or ignore the entire service indiscriminately and cannot tell personal from corporate use or judge the data being sent. Blocking outbound UDP on the server segment does nothing to an HTTPS upload over TCP. Email DLP watches messages and attachments, not web uploads to cloud storage, so it never sees this channel. Exam caveat: servers usually should not have general internet access at all, so egress restrictions on the server segment are an important complementary control. Operational check: review cloud application discovery reports for the server's identity and confirm uploads to the unsanctioned app are now blocked.