What is DLP and how would a TA implement DLP controls in a trusted environment?

• A. DLP detects and prevents data exfiltration; implement policies to monitor data in motion, at rest, and in use; enforce with attestation-enabled controls and encryption.
• B. DLP is antivirus for data.
• C. DLP only applies to data in use.
• D. DLP is a physical security measure.

Answer: (A)

DLP, or Data Loss Prevention, is about stopping sensitive information from leaving the organization. In a trusted environment, you implement DLP by classifying data and applying policies that cover data in motion, at rest, and in use. Enforcement relies on controls like encryption to protect data at rest and in transit, and attestation-enabled mechanisms to verify the device or endpoint’s integrity before data can be accessed or transmitted. DLP also monitors data flows and content patterns to detect potential leakage and can block or quarantine data when needed. This combination—detecting potential exfiltration and enforcing protections across all data states with attestation and encryption—is what makes DLP effective. It isn’t simply antivirus for data, it isn’t limited to data in use, and it isn’t a physical security measure.