Data Loss Prevention and Data Security Policies
Domain 7 covers the data security feature set: classifiers, data security policies, destination matching, and actions. Expect questions where the traffic is allowed by the access policy but still must not leave the organization.
Concepts
- Data security requires the appropriate license; classifiers include data identification (credit card numbers, national IDs, and similar patterns), content matching (custom regular expressions and keyword lists), file type, and custom classifications.
- Data security policies evaluate outbound content: HTTP POST/PUT uploads, webmail attachments, and form submissions. HTTPS requires decryption to be inspected.
- Destinations are defined by URL category or custom category, such as online storage or webmail, and combined with identity to scope who is affected.
- Actions are Allow, Monitor, and Block, with a user notification page for blocks.
- Filters inside a policy are evaluated in order, and the first matching filter decides.
- Access policy is evaluated first; if it blocks, data security never sees the transaction.
Worked example
Uploads containing five or more credit card numbers to online storage or webmail must be blocked, everything else monitored. Reasoning: build filter one with a data identification classifier for payment card numbers, destination set to the cloud-storage custom category, action Block; build filter two with Monitor for all destinations; place the Block filter first so it is evaluated ahead of the monitor rule. Test with a generated sample file and confirm in the data security reports and access logs.
Traps that cost marks
- Expecting DLP to inspect HTTPS uploads without decryption enabled.
- Writing regexes that match too broadly and generate false positives on legitimate documents.
- Assuming Monitor produces a block page; it only records the event.
- Expecting data security to scan downloads; it is an outbound control.
- Reversing filter order so a broad monitor filter matches before the block filter.