mediumMultiple Choice
CCSP Practice Question: A company uses a cloud-based data loss prevention…
A company uses a cloud-based data loss prevention (DLP) tool to monitor data access. They notice that a user is bypassing DLP by accessing data directly via cloud APIs from a non-corporate device. What is the most effective way to prevent this?
⚠ Common exam trap
ISC2 often tests the misconception that network-level controls like VPNs or device-based conditional access are sufficient to prevent data exfiltration via APIs, when in fact only content-aware inspection at the API layer can enforce DLP on the actual data being transferred.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the cloud service to require all API requests to go through a proxy that enforces DLP
Routing all API traffic through a proxy that enforces DLP ensures that every API request is inspected for sensitive data before reaching the cloud service. This approach closes the gap where a user bypasses the DLP tool by accessing data directly via cloud APIs from a non-corporate device, as the proxy acts as a mandatory intermediary that can apply content inspection, policy enforcement, and logging regardless of the device or network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a virtual private network (VPN) and require all API traffic to originate from within the VPN
Why it's wrong here
A VPN constrains network origin, yet cloud APIs are publicly reachable, so a non-corporate device can still call them over the internet without the tunnel; MGN-style source routing is irrelevant here. It is tempting because VPNs are the classic control for forcing traffic through inspected corporate egress, and would be correct if the API endpoint were genuinely private and unreachable otherwise.
- ✓
Configure the cloud service to require all API requests to go through a proxy that enforces DLP
Why this is correct
Routing all API requests through a DLP-enforcing proxy means policy inspection happens regardless of device or network, closing the direct-API bypass. Non-corporate devices can no longer reach the cloud service's APIs without passing through the control point.
- ✗
Implement a conditional access policy to block non-corporate devices
Why it's wrong here
Conditional access governs authentication and session issuance, not the API data path itself; a stolen or service token from a non-corporate device still reaches the cloud API directly. It is tempting because it is the standard control for restricting device-based access to cloud apps, and would be correct if the requirement were merely to block unmanaged endpoints at sign-in.
- ✗
Use tokenization to replace sensitive data before allowing API access
Why it's wrong here
Tokenisation substitutes stored sensitive values with surrogates, but it does not stop a user calling cloud APIs from an unmanaged device; the API call still proceeds and returns whatever the tokenised store holds. It is tempting because it is a genuine data-minimisation control for reducing breach scope, and would be correct where regulatory scope reduction, not access-path enforcement, is the goal.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.