Outbound email and file uploads that contain Social Security numbers from municipal systems should be blocked or alerted. Which security control primarily addresses that requirement?
Select an answer to reveal the explanation.
Short Explanation
DLP is the gate guard that spots an SSN in an outbound email or upload and either stops it or raises a flag. You do not have to shut down all mail—just catch the sensitive stuff trying to walk out. Speed-at-all-costs with no content checks is how exfiltration slides through.
Full Explanation
Data loss prevention (DLP) detects sensitive data patterns—such as Social Security numbers—on exfiltration paths like outbound email and uploads, then blocks or alerts according to policy. That control primarily addresses leakage of municipal sensitive data from systems that should not send SSNs externally without authorization. DLP supports privacy and compliance duties to residents.
Disabling all outbound mail so no city communication can leave the network is an overly blunt availability hit. Publishing SSN patterns in public status pages for "transparency testing" exposes detection logic uselessly. Turning off TLS inspection and content checks to maximize transfer speed weakens DLP effectiveness where inspection is lawfully used.
Exam caveat: DLP is about sensitive-data exfiltration detection/prevention; it is not a substitute for classification, encryption, or access control. False positives need tuning.
Operational check: define SSN and other PII detectors, apply policies to email and file upload channels, test with sanctioned samples in a lab, tune allowlists for legitimate benefits workflows, and triage alerts with privacy/security staff. Document incident handling for confirmed DLP blocks.