CISA Question of the Day: Data Loss Prevention Controls

Quiz Yazan Ibrahim

CISA exam practice question — CISA Question of the Day: Data Loss Prevention Controls

CISA exam practice question: daily practice for the Certified Information Systems Auditor (CISA) exam — domain: Protection of Information Assets.

Question

During an audit of a mid-sized firm, you discover several incidents where employees compressed sensitive documents and sent them to personal email accounts to bypass blocking rules. Management asks for your recommendation to reduce data exfiltration risk while minimizing business disruption. Which audit recommendation most effectively addresses the control gap?

  • A. Block all outgoing email attachments companywide to prevent any file transfer to external addresses
  • B. Rely primarily on updated employee awareness training and disciplinary measures to reduce risky behavior
  • C. Deploy an integrated Data Loss Prevention solution combining endpoint agents, network/content inspection, and policy-based blocking, plus monitoring and incident response
  • D. Mandate use of approved cloud file-sharing portals without implementing enforcement or monitoring of transfers
Show the answer and explanation

Correct answer: C. Deploy an integrated Data Loss Prevention solution combining endpoint agents, network/content inspection, and policy-based blocking, plus monitoring and incident response

The best recommendation is to deploy an integrated DLP solution with endpoint agents and network/content inspection, plus policy-based blocking, monitoring and incident response. This approach prevents common bypass techniques (zipping and emailing) at both endpoints and the gateway while enabling alerts and remediation with minimal unnecessary disruption. Blocking all outgoing attachments is overly disruptive and harms legitimate business use. Relying mainly on training is insufficient because technical controls are needed to reliably prevent intentional or accidental exfiltration. Mandating portals without enforcement or monitoring still allows unmanaged transfers and provides no assurance that users will comply or that sensitive data is blocked.

Want more practice?

Prepare for the Certified Information Systems Auditor (CISA) exam with IT Department Audit: Risk, IT Control and Governance Evaluation.