hardMultiple ChoiceObjective-mapped
CISSP Practice Question: Implements a data loss prevention (DLP) solution
An organization implements a data loss prevention (DLP) solution. Which action is most effective for protecting data at rest on endpoint devices?
⚠ Common exam trap
ISC2 often tests the distinction between data states (at rest, in motion, in use) and the specific controls that apply to each; the trap here is that candidates confuse network DLP (data in motion) with endpoint DLP (data at rest), or they select a general security control like user training instead of the direct technical control for data at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encryption of files
Encryption of files directly protects data at rest on endpoint devices by rendering the data unreadable without the appropriate decryption key. This ensures that even if an endpoint is lost, stolen, or accessed by an unauthorized user, the data remains confidential. DLP solutions often integrate with file-level encryption (e.g., BitLocker, FileVault, or EFS) to enforce policy-based encryption on sensitive files at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Encryption of files
Why this is correct
Encryption of files directly protects data at rest by rendering it unreadable to unauthorized individuals, even if it is successfully exfiltrated from the organization's control. This method ensures that sensitive information remains confidential, providing a critical layer of defense against data breaches where DLP might fail to prevent the initial data movement. It is a foundational technical control for data protection on endpoints.
- ✗
User awareness training
Why it's wrong here
User awareness training educates employees on data handling policies, security best practices, and the importance of protecting sensitive information, thereby reducing the likelihood of accidental or intentional data loss. While crucial for fostering a security-conscious culture and mitigating human-related risks, it is a preventative administrative control and does not provide direct technical protection for data at rest on endpoints. It relies on human adherence rather than technical enforcement.
- ✗
USB port blocking
Why it's wrong here
USB port blocking is a technical control designed to prevent data exfiltration by physically or logically disabling external storage device access, thereby stopping unauthorized copying of files to portable media. While effective at mitigating a specific exfiltration vector, this measure does not inherently encrypt or secure the data residing on the endpoint's internal storage. The data remains vulnerable if accessed or exfiltrated through other means.
- ✗
Network DLP monitoring
Why it's wrong here
Network DLP monitoring solutions inspect data packets traversing the network perimeter and internal segments for sensitive information, aiming to detect and prevent unauthorized data transmission outside the organization. This capability focuses on data *in transit* across network boundaries or between systems. It does not, however, provide direct protection or encryption for data stored *at rest* on individual endpoints or servers within the network.
Go deeper
Related to this question
Learn chapter
Asset Security: Privacy and Data Retention
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.