Residents’ tax return PDFs keep leaving the city network through clerks’ personal webmail accounts. Which control class best detects and blocks that exfiltration while still allowing approved business email?

Unauthorized exfiltration of resident tax-return PDFs through personal webmail is a classic data-in-motion loss path: clerks can attach or upload classified files to consumer mail services that sit outside municipal monitoring and retention. Data Loss Prevention (DLP) is the control class designed for this problem. Policies inspect outbound channels—web proxies, email gateways, browser uploads—for tax-file markers such as document fingerprints, structured identifiers, classification labels, or content patterns, then block or quarantine unauthorized transfers while allowing traffic through the approved municipal email system. Replacing keyboards to slow typing does not address the channel, the classification, or the destination; it is theater that leaves webmail open. Break-room posters and trust-only programs may raise awareness but provide no detection or enforcement when a clerk uploads a PDF after hours. Disabling all municipal email and forcing personal accounts worsens the problem by removing the sanctioned channel and pushing sensitive work entirely onto unmanaged services. Exam caveat: distinguish DLP (content-aware prevention/detection on egress) from pure encryption, IAM, or awareness; multi-select or scenario items often tempt candidates to pick convenience or culture-only answers. Operational check: inventory outbound paths clerks actually use, enable DLP on those paths with tax-document detectors and block actions for personal webmail, whitelist the official mail domain, tune false positives with assessor staff, and review DLP incident queues as a recurring control metric.