During a security review, several developers admit that they sometimes upload customer database extracts to their personal cloud-storage accounts using a web browser. Compliance now requires that any outbound transfer of unencrypted files containing U.S. Social Security numbers be blocked before the data leaves the corporate network. The server administrator needs a data loss prevention control that:
inspects outbound web traffic, including HTTPS
uses pattern or exact data matching for SSNs
can stop the upload in real time
does not rely on installing an agent on every workstation
Which of the following solutions would BEST meet these requirements?
Run a storage DLP scanner that periodically searches SMB file shares for files containing Social Security numbers.
Implement a network-based DLP proxy on the internet egress firewall that performs SSL/TLS deep inspection and blocks policy-violating uploads.
Configure the secure email gateway to strip or quarantine messages that contain Social Security numbers.
Deploy endpoint DLP agents that disable USB mass-storage devices on every workstation.
A network-based DLP proxy deployed at the internet egress point (or in the cloud) decrypts and inspects HTTPS traffic with SSL/TLS deep inspection. This allows it to detect sensitive patterns such as Social Security numbers and immediately block unauthorized file uploads-all without endpoint agents. Endpoint DLP with device control blocks removable media but still needs an agent and does not inspect browser traffic. A storage DLP scanner only finds sensitive data at rest and cannot act on live outbound transfers. An email-gateway DLP rule protects SMTP traffic but does nothing for web uploads. Therefore, the network DLP proxy with SSL inspection is the most appropriate choice.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is SSL/TLS deep inspection and why is it important for a network-based DLP proxy?
Open an interactive chat with Bash
What are the main differences between a network-based DLP proxy and an endpoint DLP agent?
Open an interactive chat with Bash
How does pattern or exact data matching work in detecting Social Security numbers?