SC-401 Data Loss Prevention Policy Basics

1. How can false positives in DLP policies be minimized?

By disabling all policy rules

Through careful tuning of sensitive information patterns and user exceptions

By only scanning emails sent to external recipients

By removing all security controls

2. How should organizations respond to a DLP policy violation incident?

Immediately terminate the employee without investigation

Investigate the incident, assess risk, document findings, and take corrective action

Ignore violations to maintain employee morale

Publicly announce all violations to deter others

3. What should be included in DLP policy training for employees?

Only technical IT jargon and complex security concepts

Policy objectives, sensitive data types, approved practices, and incident reporting

Training is unnecessary for DLP effectiveness

Only punitive consequences for violations

4. How can organizations balance DLP security with user productivity?

Eliminate all security policies

Apply policies only to executives

Regularly review and tune policies; provide clear guidance on approved data handling

Disable DLP during business hours

5. Which stakeholder group should be involved in DLP policy development?

Only IT security personnel

Only executive management

Security, legal, compliance, business units, and HR

Only external consultants

6. What is the difference between a DLP policy in audit mode versus enforcement mode?

Audit mode blocks all data transfers; enforcement mode allows them

Audit mode logs violations without blocking; enforcement mode blocks and logs

There is no difference between the two modes

Enforcement mode only applies to executives

7. How should DLP policies handle cloud storage services?

Cloud services should never be monitored

Monitor uploads and shares of sensitive data to unapproved cloud services

Allow all cloud transfers without restrictions

Only monitor data within the organization's own servers

8. What is a 'policy scope' in DLP implementation?

The geographic location of the data center

The definition of which users, locations, and services the policy applies to

The cost budget for security software

The employee's job title level

9. Which communication channel is typically monitored by DLP policies?

Email and cloud file sharing only

In-person conversations and printed documents

Email, instant messaging, file transfers, and cloud services

Phone calls exclusively

10. What role do user exceptions play in DLP policies?

They allow users to ignore all security policies

They permit specific, approved scenarios to bypass policy restrictions

They eliminate the need for policy enforcement

They reduce organizational data protection requirements

11. What is the primary goal of a Data Loss Prevention (DLP) policy?

Monitor and prevent unauthorized transmission of sensitive data

Completely eliminate all data storage on employee devices

Replace traditional firewall security measures

Encrypt all network traffic automatically

12. What is the purpose of DLP incident reporting?

To publicly shame employees who violate policies

To track, analyze, and respond to data exposure attempts

To increase employee workload with paperwork

To eliminate the need for security audits

13. Which of these is NOT typically a DLP policy action?

Blocking email transmission

Requiring business justification

Adding a watermark to documents

Automatically promoting employee salaries

14. What is a 'policy tip' in Microsoft DLP?

A financial incentive for policy compliance

A notification shown to users when they attempt to send sensitive data

A reminder email sent weekly to all employees

A discount on security software licenses

15. How do DLP policies typically identify credit card numbers?

By searching for the word 'credit' in documents

Through pattern matching for 16-digit sequences matching card formats

By requiring manual flagging from users

Only through watermarked documents

16. What does 'sensitive information type' mean in DLP terminology?

Data marked with high classification labels

A defined pattern or format that identifies specific data categories

Information stored in encrypted databases

Data that is older than one year

17. Which action can a DLP policy take when sensitive data is detected?

Allow unrestricted transmission with logging only

Block transmission and notify the user

Delete the data automatically without warning

Archive the data indefinitely

18. What is a DLP rule?

A guideline for employee conduct regarding data handling

A specific condition and action pair that identifies and responds to sensitive data

A backup procedure for critical data

A certification required for data administrators

19. DLP policies typically operate at which of these locations?

Endpoints only

Network perimeter only

Endpoints, network, and cloud services

Email servers exclusively

20. Which of the following is considered sensitive information in most DLP policies?

Public company announcements and press releases

Personally identifiable information (PII) and financial data

Employee directory and office locations

Published research papers and case studies

SC-401 Data Loss Prevention Policy Basics Quiz