I85PREP
⌘ K
CC-CEM study materials
CC-CEM study resources

CC-CEM: Outbound Security, DLP and Encryption

CC-CEM · Work through your exam, one topic at a time.

All guide sections

Outbound Security, DLP and Encryption

This domain covers the controls that govern what leaves the tenant and in what form. Questions test outbound reputation protection, data loss prevention policy logic, and the difference between transport encryption and message-level encryption.

Outbound security

  • Outbound spam filtering throttles or blocks compromised mailboxes, which is the main defence against internal spam relays.
  • Publish SPF for every egress source, sign DKIM per sending domain, and move DMARC to p=reject once reports are clean.
  • Restrict auto-forwarding to external domains at both the remote-domain and transport-rule layers; silent forwarding is a primary exfiltration path for BEC.
  • Outbound connectors can enforce TLS with a partner, and MTA-STS or DANE harden inbound SMTP against downgrade.

DLP

A policy is conditions plus exceptions plus actions. Sensitive information types combine a pattern, supporting evidence such as keywords or checksums, and a confidence level; exact data match and document fingerprinting raise precision for structured records. Actions include block, block with override and justification, encrypt, notify, and show a policy tip. Policy tips are client-dependent, so they are not a control on their own.

Encryption

  • Transport: opportunistic STARTTLS only guarantees encryption if the peer supports it; forced TLS on a connector is the enforceable option.
  • Message: S/MIME for end-to-end recipient-held keys, portal-based encryption that wraps the message in a link, and rights management tied to sensitivity labels.
  • Keys: tenant-level customer key or bring-your-own-key applies to the service, not to a single mailbox; losing key material is an outage, not a per-user event.

Worked example

A policy must stop customer card numbers leaving to external recipients. Build a sensitive information type with the card pattern plus a Luhn check at high confidence, add exact data match against the customer master list, condition on external recipients only, and action as block-with-override requiring business justification. Reasoning: raw regex alone generates false positives on order numbers; layering checksum and EDM evidence lifts precision, and the override path keeps legitimate business moving while logging exceptions.

Traps

  • Expecting DLP on unlicensed or on-premises mailboxes.
  • Treating opportunistic TLS as proof of encryption for an auditor.
  • Assuming a sensitivity label overrides a DLP policy - precedence rules decide.
  • Overlooking mailbox-level forwarding rules when auditing exfiltration paths.