Backup tapes leave the building nightly, and USB ports on clerk PCs are a known exfiltration path. Which layered approach addresses both risks?
Select an answer to reveal the explanation.
Short Explanation
Two doors, two locks: encrypt the tapes that roll out the loading dock, and clamp down USB so clerks can’t walk out with a stick full of tax data. Fancy courier badges don’t encrypt anything. Skipping backups ‘to be safe’ just breaks recovery.
Full Explanation
Tax files leaving the facility on backup media must be encrypted so courier loss or theft does not expose resident financial data. Concurrently, endpoints need USB exfiltration restrictions—technical controls and policy—so clerks cannot copy tax databases to unmanaged sticks. Together those measures address two common offline leakage paths: authorized backup transport and unauthorized portable media.
Leaving backups unencrypted because a courier badge looks official confuses identity theater with cryptography. Allowing unrestricted USB copy while backups stay onsite still permits easy insider or malware-assisted theft. Disabling backup jobs to avoid tape-handling risk destroys recoverability and fails operational resilience.
Exam caveat: encryption of backups and DLP/device control are complementary. Offsite copies still need key management so recovery remains possible after disaster; USB controls need exceptions workflows for legitimate IT use.
Operational check: verify backup encryption at rest for portable media, test restores with available keys, enable USB device control with auditing on tax workstations, and spot-check courier chain-of-custody logs for media that left the building.