hardMultiple ChoiceObjective-mapped
CISA Practice Question: A multinational corporation is deploying a data…
A multinational corporation is deploying a data loss prevention (DLP) solution across its network. The DLP system must be configured to prevent the exfiltration of personally identifiable information (PII) while minimizing false positives. Which approach is most effective?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use regex patterns for PII combined with context-aware policies (e.g., user role, destination domain)
Using regex patterns for PII combined with context-aware policies (e.g., user role, destination domain) allows the DLP system to accurately detect sensitive data while minimizing false positives. Option A is too simplistic; keyword-based blocking can cause high false positives. Option B relies on user training and self-reporting, which is not a technical DLP control and is ineffective. Option C (encryption) protects data at rest and in transit but does not prevent exfiltration; it is not a DLP method.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block all outbound email containing keywords such as 'SSN' or 'credit card'
Why it's wrong here
Keyword matching can cause high false positives and misses structured data.
- ✗
Require all users to complete annual data handling training and rely on self-reporting
Why it's wrong here
Training is important but not a technical DLP control.
- ✗
Implement full disk encryption on all endpoints and encrypt all outbound traffic
Why it's wrong here
Encryption prevents unauthorized access but does not prevent exfiltration by authorized users.
- ✓
Use regex patterns for PII combined with context-aware policies (e.g., user role, destination domain)
Why this is correct
Regex with context reduces false positives and accurately detects PII.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.