In a Data Loss Prevention (DLP) architecture, which component is commonly used to block USB devices at endpoints?

• A. Encrypt at rest
• B. Provide single sign-on
• C. Block USB devices
• D. Use MFA

Answer: (C)

Blocking USB devices at endpoints is a direct enforcement action in DLP to stop data from leaving the organization via removable media. By configuring endpoint controls to deny or restrict USB mass storage devices, the system prevents copies of sensitive data from being written to USB drives, which is a common exfiltration path DLP aims to mitigate. This kind of device-control capability is a practical, hands-on way to enforce data protection at the point of use.

Encrypting data at rest protects data on storage media if it’s stolen or accessed, but it doesn’t stop data from being copied onto a USB device in the first place. MFA and SSO focus on who can access systems, not on preventing data transfer through external devices.