Cybersecurity and Response Planningintermediate
Describe how a DLP solution might respond when it detects sensitive data stored in violation of policy.
Answer
It may alert the organization, encrypt the data where it is located, or move the data and leave a note pointing to its new location. Alerting is a less intrusive response. Encryption and moving data are generally applied after the solution has operated long enough to reduce the likelihood of false positives.
Explanation
### The concept
A DLP solution can respond to a storage violation in several ways. It can notify staff so they can investigate, encrypt the data at its current location, or move it and leave a note identifying where it went. These actions have different operational effects: alerting informs, while encryption or relocation changes access or location. The material cautions that automatic changes are generally used after the solution has been in place and false-positive likelihood is lower.
### What a good answer covers
- Identify alerting as one possible response.
- Identify encryption at the current location as another response.
- Explain that the solution may move data and leave a location note.
- Explain why automated changes are safer after false-positive likelihood has decreased.
### Terms
- **False positive**: An alert or classification that incorrectly identifies benign activity as a violation.
### Remember
Start with detection and confidence before allowing a tool to change data.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free