Monitoring shows employees uploading customer lists from company-managed laptops to personal cloud storage accounts through a web browser. Leadership wants this movement of sensitive data detected and blocked. Where should DLP enforcement be placed?
Select an answer to reveal the explanation.
Short Explanation
You catch shoplifters at the exit, not by counting stock in the back room once a week. DLP that blocks this leak has to sit where the data actually leaves: the endpoint and the network egress. You've got no control over somebody's personal cloud account, so don't count on enforcing anything there.
Full Explanation
DLP has three main functions: discovering where sensitive data resides, monitoring its use and movement, and enforcing policy to stop prohibited actions. The problem described is data in motion leaving managed devices toward unsanctioned personal cloud services, so enforcement must be placed where that traffic can be seen and stopped. Endpoint DLP agents on managed laptops can inspect content before it is uploaded through a browser, and network or proxy-based DLP at egress can inspect outbound traffic and block uploads to unapproved destinations; a CASB in inline mode can complement this for cloud services. Scanning sanctioned repositories weekly is discovery of data at rest; it may find where customer lists live, but it does not stop an upload happening now. The company has no administrative control over employees' personal cloud accounts, so it cannot enforce policy inside that service. Classifying records in the HR system improves awareness and supports policy, but classification alone does not detect or block anything. Exam caveat: DLP effectiveness depends on accurate classification and on visibility into encrypted traffic. Operational check: test by uploading a seeded sample file to a personal storage site from a managed laptop and confirm the upload is blocked and logged.