Employees' laptops frequently work from home and travel without connecting to the corporate VPN, and the company must stop sensitive files from being uploaded to personal cloud storage wherever the laptop happens to be. Which data loss prevention approach fits best?
Select an answer to reveal the explanation.
Short Explanation
If the laptop leaves the building, the guard has to go with it. An agent rides along on every endpoint and checks uploads wherever you are, while a central proxy only sees traffic that actually passes through headquarters. Off the VPN, that proxy's blind.
Full Explanation
Agent-based data loss prevention installs software on each endpoint that inspects content and enforces policy locally, for example blocking a browser or sync client from uploading files that match sensitive data rules. Because enforcement happens on the device itself, it applies at home, in hotels or on any network, which matches the requirement that uploads be stopped wherever the laptop is. A centralized data loss prevention proxy at the headquarters egress point inspects only traffic that flows through it; laptops working off the VPN reach the internet directly and bypass it entirely. A URL category filter on the office perimeter firewall has the same limitation and, even on site, blocks whole categories of sites rather than inspecting file content, so it cannot distinguish sensitive files from harmless ones. Full-disk encryption protects data at rest if the laptop is lost or stolen, but files are decrypted transparently for the signed-in user and can be uploaded freely, so it does nothing to prevent exfiltration. Exam caveat: agent coverage depends on deployment and tamper protection, so organizations often pair endpoint agents with a centralized or cloud-delivered inspection point. Operational check: on a laptop disconnected from the VPN, attempt to upload a test file containing sample sensitive data to a personal storage site, confirm the agent blocks it, and confirm the event reaches the central console.