CISSP Security Operations Practice Question
What type of DLP system monitors data in motion across the network?
⚠ Common exam trap
The trap is confusing the three states of data (motion, rest, use) and selecting endpoint or storage DLP; the key is recognizing that 'in motion across the network' specifically points to Network DLP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Network DLP
Network DLP (A) is designed to monitor data in motion across the network, inspecting traffic for sensitive information being transmitted. It sits at network egress points and analyzes protocols like HTTP, SMTP, and FTP to prevent data exfiltration. This directly matches the requirement to monitor data in motion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Network DLP
Why this is correct
Network DLP systems specifically monitor "data in motion" by inspecting network traffic as it traverses the organization's boundaries or internal segments. These solutions typically employ deep packet inspection (DPI) to analyze data streams for sensitive content, patterns, or metadata, preventing unauthorized transmission over protocols like HTTP, FTP, or email. They are often deployed at network egress points or internal chokepoints to enforce data security policies.
- ✗
Storage DLP
Why it's wrong here
The term "Storage DLP" is not a distinct, industry-recognized category within Data Loss Prevention solutions. Instead, the function of protecting data stored on various mediums, whether local file systems, network shares, or cloud repositories, is typically handled by other DLP types. For instance, Endpoint DLP secures data at rest on individual devices, while Cloud DLP addresses data stored within cloud services, making "Storage DLP" redundant as a separate classification.
- ✗
Endpoint DLP
Why it's wrong here
Endpoint DLP focuses on protecting "data at rest" and "data in use" directly on user workstations, laptops, and mobile devices. It monitors user activities, such as copying files to USB drives, printing documents, or uploading data to personal cloud storage, preventing unauthorized data exfiltration from the device itself. Unlike network DLP, it operates locally on the endpoint, enforcing policies before data ever attempts to move across the network.
- ✗
Cloud DLP
Why it's wrong here
Cloud DLP solutions are designed to protect sensitive data residing within cloud environments, encompassing "data at rest" in cloud storage and "data in use" within cloud applications. These systems integrate with Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), and Infrastructure-as-a-Service (IaaS) platforms, often leveraging APIs to scan files, databases, and communications for policy violations. Their primary scope is data *within* the cloud provider's infrastructure, not necessarily data transiting the customer's on-premise network.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.