Enterprise DLP
Enterprise DLP tests how data is identified, classified, and controlled consistently across Prisma Access, SaaS Security, endpoint, and email. The exam focuses on profiles, patterns, actions, and why context matters.
Core rules
- Data patterns identify data: predefined (credit card, SSN, bank account), custom regex/keywords, exact data match (EDM), document fingerprinting, and ML-based classifiers.
- DLP profiles combine patterns with weights/thresholds and confidence; a profile is not just one regex.
- Policy rules bind source, destination, user/group, data profile, and action: alert, block, quarantine, or tunnel to a remediation workflow.
- Decryption is a prerequisite: if traffic is encrypted and not decrypted, DLP cannot inspect it.
- Centralized management in Strata Cloud Manager lets one profile apply across channels, but each channel must support the action.
Worked example
A DLP profile flags credit-card numbers with a predefined pattern plus a threshold of two matches. A user uploads a file to an unsanctioned SaaS app through Prisma Access. The rule matches the user group, the file destination, and the profile, so the action blocks the upload and alerts. If the same file were uploaded over TLS without decryption, no match would occur. Reasoning: DLP requires visibility first, then a matching profile, then an action.
Traps
- Writing regex without testing false positives/negatives.
- Forgetting decryption for encrypted traffic.
- Assuming a data pattern alone enforces policy.
- Confusing data filtering profiles with DLP profiles.
- Ignoring channel coverage: endpoint, SaaS, web, and email are configured separately.