mediumMultiple ChoiceObjective-mapped
CCSP Practice Question: A company uses a cloud-based data loss prevention…
A company uses a cloud-based data loss prevention (DLP) tool to monitor data access. They notice that a user is bypassing DLP by accessing data directly via cloud APIs from a non-corporate device. What is the most effective way to prevent this?
⚠ Common exam trap
ISC2 often tests the misconception that network-level controls like VPNs or device-based conditional access are sufficient to prevent data exfiltration via APIs, when in fact only content-aware inspection at the API layer can enforce DLP on the actual data being transferred.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the cloud service to require all API requests to go through a proxy that enforces DLP
Routing all API traffic through a proxy that enforces DLP ensures that every API request is inspected for sensitive data before reaching the cloud service. This approach closes the gap where a user bypasses the DLP tool by accessing data directly via cloud APIs from a non-corporate device, as the proxy acts as a mandatory intermediary that can apply content inspection, policy enforcement, and logging regardless of the device or network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a virtual private network (VPN) and require all API traffic to originate from within the VPN
Why it's wrong here
VPN does not provide data inspection capabilities.
- ✓
Configure the cloud service to require all API requests to go through a proxy that enforces DLP
Why this is correct
Forces all API traffic through a proxy that can apply DLP rules.
- ✗
Implement a conditional access policy to block non-corporate devices
Why it's wrong here
Device-level control may not cover all API access methods.
- ✗
Use tokenization to replace sensitive data before allowing API access
Why it's wrong here
Tokenization does not prevent data exfiltration.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.