CISSP Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Network DLP

  Why this is correct

  Network DLP systems specifically monitor "data in motion" by inspecting network traffic as it traverses the organization's boundaries or internal segments. These solutions typically employ deep packet inspection (DPI) to analyze data streams for sensitive content, patterns, or metadata, preventing unauthorized transmission over protocols like HTTP, FTP, or email. They are often deployed at network egress points or internal chokepoints to enforce data security policies.

• ✗

  Storage DLP

  Why it's wrong here

  The term "Storage DLP" is not a distinct, industry-recognized category within Data Loss Prevention solutions. Instead, the function of protecting data stored on various mediums, whether local file systems, network shares, or cloud repositories, is typically handled by other DLP types. For instance, Endpoint DLP secures data at rest on individual devices, while Cloud DLP addresses data stored within cloud services, making "Storage DLP" redundant as a separate classification.

• ✗

  Endpoint DLP

  Why it's wrong here

  Endpoint DLP focuses on protecting "data at rest" and "data in use" directly on user workstations, laptops, and mobile devices. It monitors user activities, such as copying files to USB drives, printing documents, or uploading data to personal cloud storage, preventing unauthorized data exfiltration from the device itself. Unlike network DLP, it operates locally on the endpoint, enforcing policies before data ever attempts to move across the network.

• ✗

  Cloud DLP

  Why it's wrong here

  Cloud DLP solutions are designed to protect sensitive data residing within cloud environments, encompassing "data at rest" in cloud storage and "data in use" within cloud applications. These systems integrate with Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), and Infrastructure-as-a-Service (IaaS) platforms, often leveraging APIs to scan files, databases, and communications for policy violations. Their primary scope is data *within* the cloud provider's infrastructure, not necessarily data transiting the customer's on-premise network.

Go deeper

Related to this question