SkillTestPro | CCNP Security 300-740 SSCA Practice Test 21

CCNP Security 300-740 SSCA Practice Test 21 (Hard) - Configuring Data Loss Prevention

CISCO CCNP Security Exam Logo

1 / 10

Which security capability inspects outbound content (such as email, web uploads, or cloud application traffic) to detect and act on sensitive information leaving an organization's control?

DNS security, which blocks malicious domain resolution rather than inspecting outbound content for sensitive data

An Intrusion Prevention System focused on inbound network attack signatures, which does not primarily focus on outbound sensitive content

An NTP server, which synchronizes clocks rather than inspecting outbound content

A DHCP server, which assigns IP addresses rather than inspecting outbound content

A Certificate Authority, which issues certificates rather than inspecting outbound content

Data Loss Prevention (DLP)

2 / 10

Which DLP detection technique identifies sensitive data by matching a cryptographic fingerprint of specific known documents or data records, rather than relying on generic pattern matching?

Blocking based solely on file size regardless of actual content

Blocking based solely on the time of day the message was sent regardless of actual content

Random sampling of a fixed percentage of outbound traffic with no relationship to document content

Blocking based solely on the sender's job title regardless of actual content

Exact data matching / document fingerprinting

Simple keyword matching alone, which looks for specific words rather than fingerprinting known documents

3 / 10

Which DLP policy action would be most appropriate for an outbound email detected as containing a customer's full payment card number in violation of policy, where the organization wants to prevent the leak while still notifying the sender?

Automatically granting the sender additional administrative privileges in response to the detection

Automatically forwarding the email to an unrelated external marketing distribution list

Automatically deleting the sender's entire email account without any review process

Automatically publishing the email's full content to an internal company-wide announcement channel

Allowing the email to be sent immediately with no action taken and no notification of any kind

Blocking the email from being sent and notifying the sender of the policy violation so they can correct it

4 / 10

Which DLP deployment consideration is important for effectively covering an organization's use of cloud storage and SaaS collaboration platforms, in addition to traditional email-based DLP?

Extending DLP policy enforcement to cloud application traffic (such as via CASB integration) so that sensitive data uploaded to or shared through SaaS platforms is also inspected

Disabling DLP entirely for any traffic destined to a cloud application to simplify configuration

Assuming cloud storage and SaaS platforms are incapable of being used to exfiltrate sensitive data

Requiring all cloud storage and SaaS usage to be manually reviewed by an administrator before each individual file upload

Applying DLP policy only to file uploads occurring during business hours, with no coverage for after-hours activity

Assuming email-based DLP alone automatically covers all data movement through cloud storage and SaaS platforms as well

5 / 10

Which practice would help reduce DLP false positives when scanning documents that legitimately contain patterns resembling sensitive data, such as internal test data with fake but realistically formatted account numbers?

Randomly allowing a fixed percentage of flagged documents through with no relationship to their actual content, which is rarely the correct choice, which is not the standard approach, which does not align with best practices

Requiring every flagged document to be manually reviewed by the organization's CEO personally

Assuming all pattern matches are always true positives with no possibility of legitimate exceptions

Blocking every single document that contains any sequence of digits regardless of context

Disabling DLP scanning entirely for the whole organization to eliminate any possibility of a false positive

Tuning DLP policies with contextual exceptions (such as recognizing designated test data repositories or specific document classifications) rather than relying on pattern matching alone

6 / 10

Which risk would most likely result from an organization deploying DLP policies with overly broad matching rules and no tuning based on actual organizational data patterns?

Overly broad DLP rules would automatically improve employee productivity with no downside whatsoever

The DLP platform would automatically narrow its own rules with no administrator involvement required

Overly broad DLP rules would automatically and perfectly detect every possible instance of sensitive data with zero false positives, under typical configuration conditions

The organization's DNS infrastructure would automatically fail as a direct result of overly broad DLP rules

All legitimate business communications would automatically be exempted from any DLP scanning

Excessive false positives could block or delay legitimate business communications, leading users to seek workarounds that bypass DLP protection entirely

7 / 10

Which combination of DLP practices would provide comprehensive, well-tuned data protection across email, web, and cloud application channels for a large organization?

Email-only DLP coverage with no inspection of web or cloud application channels at all, in accordance with common design practices, which is not the standard approach

Multi-channel DLP coverage (email, web, and CASB-integrated cloud application inspection), a mix of detection techniques (keyword, pattern, and document fingerprinting), contextual tuning to reduce false positives, and clear policy actions with sender notification

Disabling DLP entirely for any communication channel that generates a high volume of traffic

Relying exclusively on simple keyword matching with no document fingerprinting or contextual tuning of any kind

Applying DLP policy with no sender notification at all, silently dropping messages with no explanation

Blocking all outbound communication indiscriminately regardless of whether sensitive data is actually detected

8 / 10

Which factor would most influence how strict an organization's DLP policy should be for outbound communications from its finance department compared to a general marketing team?

The specific brand of coffee served in the finance department's break room

The sensitivity and regulatory protection requirements of the specific data types (such as payment or financial records) that the finance department routinely handles

The font used in the finance department's internal newsletter

The number of parking spaces reserved for the finance department's staff

The average outdoor temperature near the finance department's office

The color scheme configured for the finance department's internal dashboard, which is rarely the correct choice, which is inconsistent with expected behavior, which does not align with best practices

9 / 10

Which troubleshooting step would be appropriate if a legitimate, policy-compliant document is being repeatedly and incorrectly flagged as a DLP violation?

Review the specific DLP rule and matching pattern that triggered the flag, and add a documented, scoped exception or refine the rule if the document is confirmed to be a false positive

Assume the issue is caused by the phase of the moon

Replace the DLP platform entirely as the first troubleshooting step for a single flagged document

Assume the document must actually be a policy violation with no further review, regardless of its confirmed legitimate status, which is inconsistent with expected behavior, in accordance with common design practices

Instruct the user to rename the file repeatedly until it is no longer flagged, with no review of the underlying rule

Immediately disable DLP scanning entirely for the whole organization to resolve the single reported issue

10 / 10

Which statement accurately describes why DLP is considered a necessary complement to network-layer controls like IPS and DNS security rather than a redundant capability?

IPS and DNS security primarily address inbound and connection-based threats, while DLP specifically focuses on detecting and preventing outbound movement of sensitive data regardless of whether the destination itself is otherwise considered malicious

DLP, IPS, and DNS security are simply three different names for the exact same identical control with no distinction

IPS and DNS security already fully address outbound sensitive data movement, making DLP entirely redundant

An organization must choose exactly one of DLP, IPS, or DNS security and can never deploy all three together

DLP focuses exclusively on inbound threat detection, which is the same function already performed by IPS

DLP is only relevant to guest network traffic and has no relevance to internal employee communications

Your score is

The average score is 0%