Forcepoint DLP Admin flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Policy-rule-action hierarchy

Forcepoint DLP organizes enforcement as a policy containing rules; each rule holds conditions and a single action. The first matching rule determines the outcome, so rule order and specificity matter.

Predefined classifier validation

Built-in classifiers such as credit card and national ID patterns apply checksum or format validation, not just regex matching. A raw pattern hit failing validation does not raise severity, reducing false positives.

Endpoint vs network channels

Endpoint DLP enforces on device actions like USB copy, print, and clipboard; network DLP enforces at SMTP and HTTP proxy. A rule scoped only to endpoint channels will not fire on email traffic.

File fingerprinting

A DLP technique that hashes registered source documents so exact or partial copies are detected regardless of renaming. Fingerprints must be refreshed after source data changes or new documents are missed.

Incident remediation actions

Administrators can release a blocked message, delete it, encrypt it, or request end-user justification. Each action is recorded with the incident for audit and workflow tracking.

Unidentified user evaluation

When directory identification fails, rules scoped to specific users or groups evaluate as non-matching and traffic falls to default rules. Verify identity resolution before concluding a classifier failed.

Discovery scan

A scheduled or on-demand task that applies DLP classifiers to data at rest across shares, endpoints, databases, and cloud stores, populating the data inventory and enabling owner notification or quarantine.

Database fingerprinting

Registers selected columns and rows from a database as a sensitive pattern. DLP then detects records matching that structure in outbound files, catching exports of customer or employee tables.

DSPM data source connector

A configured integration to a repository such as S3, SharePoint, or Google Drive. It uses least-privilege read credentials, and missing scopes produce partial scans with misleadingly low findings.

DSPM finding

A classified file or object plus its exposure context, such as containing PII and being publicly shared. Findings differ from DLP incidents, which record transfer events rather than stored posture.

DSPM risk prioritization

Risk combines classifier sensitivity, exposure level such as public link or missing encryption, and blast radius of users with access. Higher combined scores surface first for remediation.

DSPM remediation options

Actions include revoking public links, removing external shares, applying sensitivity labels, quarantining files, and notifying data owners. Remediation status feeds the posture risk score until closure.

DSPM to DLP feedback

DSPM findings identify repositories holding exposed sensitive data, which informs DLP rule tuning. DSPM-applied labels can also serve as DLP conditions for egress enforcement.

Data owner assignment

DSPM maps findings to business stewards so remediation is delegated. Unassigned findings stay open and continue inflating the organizational risk score until an owner resolves them.

Scan scope comparability

Posture trend comparisons require consistent connector scope across periods. Changing what a scan covers invalidates period-over-period deltas because the denominator of scanned data changed.

DSPM vs DLP distinction

DSPM evaluates stored data posture, asking whether sensitive files are exposed. DLP evaluates transfer events, asking whether a user moved sensitive data. Confusing these two is a common exam error.

Web Security deployment modes

Options are on-premises Content Gateway, hybrid with cloud policy, and fully hosted Web Security Cloud. Policy structure stays the same; only the enforcement point and management plane differ.

URL category precedence

Explicit custom URL entries override cloud category assignment. Per-tenant recategorization requests change how a site is classified for that organization without affecting other tenants.

Top-down rule order

Web policy rules evaluate from top to bottom and the first match wins unless the rule uses continue. A broad allow placed above a specific block silently permits the traffic.

HTTPS inspection bypass

Certificate-pinned applications break when the proxy decrypts TLS. Bypass lists must include banking and pinned SaaS apps, or those applications fail silently for users behind inspection.

Web authentication modes

Transparent directory-based, explicit proxy prompt, and SAML identity provider options exist. Rules keyed on user or group need successful identification; unidentified traffic falls to default rules.

Time and bandwidth quotas

Quota actions allow access until a per-user time or byte threshold is reached, then apply a block or confirm action. Quotas reset on the configured schedule, typically daily.

Cloud Web Security agent

An endpoint agent or PAC file extends web filtering to users off the corporate network. It uses the same policy as on-premises proxy enforcement but a different enforcement path.

Web log fields

Per-request logs record user, URL, category, action taken, and bytes transferred. Export to SIEM uses syslog or CEF, and retention is bounded by appliance or cloud subscription tier.

CASB API mode

Out-of-band connectivity to sanctioned SaaS via OAuth or API. It gives visibility and retroactive control such as removing public shares, but cannot interrupt a user action in real time.

CASB forward proxy mode

Inline control through Web Security for managed devices. It inspects uploads, downloads, and sharing in real time and can block, coach, or watermark before the action completes.

CASB reverse proxy mode

Inline control for unmanaged devices without an agent, routing SaaS access through the CASB proxy. It enables real-time policy on BYOD but requires DNS or app configuration changes.

Shadow IT discovery

Identifies unsanctioned cloud applications from web proxy logs and scores them by vendor security posture and compliance. Sanctioned versus unsanctioned status determines which policy set applies.

CASB coaching action

Presents a justification dialog requiring a business reason before allowing an action, storing the reason with the incident. Coaching works only on inline paths; API mode cannot interrupt users.

CASB consent revocation

Revoking the CASB app's tenant consent immediately stops API-based visibility and retroactive control, while inline proxy enforcement continues unaffected. This split is a frequent exam scenario.

CASB behavioral detections

Anomaly rules flag impossible travel, mass downloads, and unusual admin activity. These are behavior-based incident types, separate from content-based DLP classifier matches.

CASB policy conditions

Rules combine app, activity, file classification from DLP classifiers, user or group, device type, and location. DLP classifiers bridge CASB and DLP by enabling content inspection of cloud files.