Data Protection and Encryption
What this domain tests
This domain tests data classification, data-loss prevention, encryption at rest and in transit, key management, and the differences among hashing, tokenization, and encryption. Expect Symantec DLP concepts such as endpoint, network, and storage channels, plus policy tuning.
Core rules
- Data states: at rest, in motion, and in use. Controls differ by state.
- DLP policy combines content detection with destination and user context. Detection can use keywords, regular expressions, fingerprints, exact data matching, and document identifiers.
- Encryption protects confidentiality but depends on key management. Losing keys loses data; weak key custody defeats encryption.
- Hashing is one-way integrity verification, not encryption. Tokenization replaces data with a surrogate value; the original is stored in a token vault.
- TLS protects data in transit; it does not protect data at rest or prevent an authorized user from copying data.
Worked example
A DLP policy blocks outbound email containing 16-digit numbers, and an order-confirmation email is falsely blocked. Reasoning: the trigger is a generic credit-card regex, not a validated card number. Improve the policy by adding Luhn validation and context conditions such as proximity to “CVV” or “expiry,” then test against a sample set. Do not whitelist the entire domain or disable the rule. The goal is fewer false positives without weakening detection.
Traps
- Treating encryption as complete without key management.
- Confusing hashing with encryption.
- Covering only email while endpoint copy and USB channels remain open.
- Using broad DLP exceptions that hide real leaks.
- Assuming TLS inspection is always permissible or technically possible.