CISA Protection of Information Assets Practice Question
An IS auditor is reviewing an organization's data loss prevention (DLP) strategy. The organization has implemented a network DLP solution but has not yet deployed endpoint DLP. Which TWO of the following are the MOST significant risks of relying solely on network DLP? (Choose two.)
⚠ Common exam trap
The trap here is assuming network DLP covers all data movement, when in fact it has blind spots at the endpoint and with encrypted traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data copied to removable media such as USB drives may not be detected.
The two most significant risks of relying solely on network DLP are that data copied to removable media may not be detected and that encrypted data traversing the network may not be inspected. Network DLP monitors data in motion across network boundaries but lacks visibility into endpoint actions like USB copying and often cannot decrypt traffic without interception. Endpoint DLP complements network DLP by monitoring data at the endpoint, closing these gaps.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network DLP does not provide visibility into data stored on file servers.
Why it's wrong here
Network DLP focuses on data in motion, not data at rest. However, the risk of not having visibility into data at rest is typically addressed by data discovery and classification tools, not necessarily endpoint DLP. Endpoint DLP also focuses on data in use and in motion from the endpoint. The question asks about risks of relying solely on network DLP, and while data-at-rest visibility is a gap, it is not as directly related to endpoint DLP as removable media and encrypted traffic.
- ✓
Data copied to removable media such as USB drives may not be detected.
Why this is correct
Network DLP monitors data in transit across the network perimeter. It does not monitor data at rest or data being copied to removable media on an endpoint. If an employee copies sensitive data to a USB drive, the network DLP will not see this action because it does not traverse the network. Endpoint DLP is required to control and monitor such activities. This is a significant gap that can lead to data exfiltration.
- ✗
Network DLP cannot prevent data leakage via email attachments.
Why it's wrong here
Network DLP can monitor and block email traffic, including attachments, if it is configured to inspect SMTP or other email protocols. It is not accurate to say it cannot prevent email leakage. While encrypted email may pose a challenge, standard email attachments can be scanned. Therefore, this is not a primary risk of network-only DLP; the more significant gaps are removable media and encrypted traffic.
- ✓
Encrypted data traversing the network may not be inspected by network DLP.
Why this is correct
Network DLP solutions often cannot inspect encrypted traffic, such as HTTPS or encrypted email, without SSL/TLS interception. If data is exfiltrated over an encrypted channel, the network DLP may be blind to it. Endpoint DLP can inspect data before it is encrypted, providing better visibility. This is a key limitation of network-only DLP, especially as more traffic becomes encrypted by default.
- ✗
Network DLP cannot monitor traffic between internal network segments.
Why it's wrong here
Network DLP can be deployed at internal network segments to monitor east-west traffic, depending on the architecture. It is not inherently limited to perimeter traffic. While some implementations focus on the perimeter, network DLP can be placed at strategic internal points. Therefore, this is not a fundamental limitation of network DLP, and it is not one of the most significant risks compared to removable media and encrypted traffic.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.