What is data loss prevention (DLP) and where should DLP be deployed to be effective?

• A. DLP detects and prevents unauthorized data exfiltration or disclosure; deploy at endpoints, email gateways, cloud services, and data repositories with policy enforcement.
• B. DLP is only for backups
• C. DLP monitors only user activity on endpoints
• D. DLP is a firewall feature

Answer: (A)

DLP is about stopping sensitive data from leaving the organization by detecting where it’s at risk and enforcing policies to prevent disclosure or exfiltration. The best approach is to deploy it where data moves or resides: on endpoints, at email gateways, in cloud services, and in data repositories, with active policy enforcement.

At endpoints, DLP agents monitor data in use and control risky actions like copying to a USB drive or sending files to unknown apps. At email gateways, DLP scans outbound messages and attachments to catch data leakage before it leaves the organization. In cloud services, DLP connectors protect data within SaaS apps and shared documents, enforcing policies across collaborative platforms. In data repositories, DLP applies rules to data at rest, preventing improper sharing or access.

This multi-point deployment is necessary because data can leak at many stages—while being used, while moving over networks, or while stored. DLP isn’t just for backups, isn’t limited to monitoring user activity only on endpoints, and isn’t simply a firewall feature, even though some firewalls offer related capabilities.