hardMultiple ChoiceObjective-mapped
CISSP Practice Question: Discovers that an employee has been using a…
An organization discovers that an employee has been using a personal cloud storage account to share confidential files. After revoking access, what is the NEXT best step to prevent recurrence?
⚠ Common exam trap
Many candidates choose retraining (D) because it seems like a proactive people-focused control, but the CISSP emphasizes that technical controls (like DLP) are necessary to enforce policy and prevent recurrence, especially after a security incident involving data exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a data loss prevention (DLP) solution
Deploying a Data Loss Prevention (DLP) solution is the next best step because it provides automated, policy-based monitoring and control of data in motion, at rest, and in use. DLP can inspect content for sensitive patterns (e.g., credit card numbers, proprietary file headers) and block unauthorized transfers to personal cloud storage, addressing the root cause of the incident rather than relying on manual enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Block access to all cloud storage sites
Why it's wrong here
Blocking access to all cloud storage sites is an overly restrictive measure that can severely impede legitimate business operations reliant on sanctioned cloud services for collaboration and data sharing. Furthermore, this control only addresses one potential exfiltration vector and fails to prevent data loss through other common channels, such as email, removable media, or internal network shares. It's a blunt instrument that lacks the granularity required for effective data protection.
- ✓
Deploy a data loss prevention (DLP) solution
Why this is correct
Deploying a Data Loss Prevention (DLP) solution is the most effective and proactive technical control for preventing unauthorized data exfiltration. DLP systems identify sensitive data based on content, context, and metadata, then monitor and block its transfer across various egress points, including email, cloud services, removable media, and network protocols. This provides continuous, policy-driven protection against both accidental and malicious data loss, ensuring compliance and safeguarding critical information assets.
- ✗
Discipline the employee
Why it's wrong here
Disciplining the employee addresses a past policy violation and serves as a corrective action for individual behavior. However, it is a reactive administrative control that does not implement technical safeguards to prevent similar incidents from occurring in the future, either by the same employee or others. Without technical preventative measures, the organization remains vulnerable to ongoing or repeated data exfiltration attempts.
- ✗
Retrain all employees on data handling policy
Why it's wrong here
Retraining all employees on data handling policy is a vital administrative control for fostering a security-aware culture and ensuring understanding of organizational expectations. While essential for reducing accidental data loss, training alone is insufficient to prevent deliberate malicious exfiltration or to enforce policies consistently across all potential egress points. Technical controls are necessary to enforce policies and mitigate risks that human error or malicious intent might exploit.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.