How to Configure DLP to Prevent Social Security Number Leakage
An administrator wants to prevent employees from uploading sensitive credit card numbers via web forms. Which security profile feature is MOST appropriate to achieve this?
⚠ Common exam trap
Watch out — candidates often confuse DLP with other security profiles like web filtering or application control, mistakenly thinking that blocking upload sites or web forms is a more direct solution, when DLP is the only feature designed for content-based data inspection and policy enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Leak Prevention (DLP) with a credit card number sensor
Data Leak Prevention (DLP) with a credit card number sensor is the most appropriate feature because it uses pattern matching (e.g., Luhn algorithm) to detect and block sensitive credit card numbers in HTTP POST requests, preventing data exfiltration via web forms. Unlike other security profiles, DLP is specifically designed to inspect content for sensitive data patterns and enforce policy actions such as blocking or logging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Antivirus with FortiSandbox integration
Why it's wrong here
Antivirus with FortiSandbox integration is incorrect because it is designed to detect and block malicious software, not to inspect the content of files for sensitive information like credit card numbers. Even if a file is malicious, that does not correlate with whether it contains regulated data, so a clean file with a credit card number would pass through undetected, failing to prevent the upload.
- ✓
Data Leak Prevention (DLP) with a credit card number sensor
Why this is correct
Data Leak Prevention (DLP) with a credit card number sensor is correct because DLP examines the actual content of traffic and matches it against predefined sensors, such as the credit card number sensor, which uses pattern matching and Luhn algorithm validation to identify PCI-DSS regulated data. When the sensor triggers, the DLP policy can block the upload session in real time, preventing the sensitive information from leaving the network.
- ✗
Web Filter to block all upload sites
Why it's wrong here
Web Filter to block all upload sites is wrong because it uses URL categorization and does not inspect the data being uploaded, so it cannot distinguish between a legitimate business file and one containing credit card numbers. Additionally, it is an overly broad measure that disrupts productive use of cloud storage and collaboration tools, and it fails to catch uploads occurring via non-web protocols such as FTP or SMTP, making it both ineffective and impractical.
- ✗
Application Control to block web forms
Why it's wrong here
Application Control to block web forms is incorrect because it identifies applications and their actions based on signatures, but it does not parse the content submitted within a form to determine if it contains sensitive data. Blocking all web forms would break countless legitimate workflows, such as login forms and online registrations, while still missing sensitive data sent through application-layer protocols or direct API calls that do not rely on traditional web forms.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.