Associate Cloud Workspace Administrator · Free Practice Question Medium
Question 36
Your company has a strict policy against sharing social security numbers via email. You've set up a DLP (Data Loss Prevention) rule to block emails containing what resembles a social security number. However, employees have reported that their emails are being blocked even when they're not including any social security numbers. What action should you take to reduce the number of legitimate emails being incorrectly blocked?
-
A
Change the action from 'Block' to 'Quarantine' to review potential false positives.
-
B
Implement an allowlist for verified internal email addresses.
-
C
Increase the minimum match count required by the DLP rule.
-
D
Lower the confidence threshold for the DLP rule.
Reveal correct answer
Correct answer: A
A. Changing the action from 'Block' to 'Quarantine' will allow potentially false positive emails to be reviewed before being completely blocked. This way, legitimate emails that are incorrectly identified as containing social security numbers can be released for delivery.
B. Implementing an allowlist for verified internal email addresses may help ensure that emails from trusted sources are not blocked by the DLP rule. However, this action does not directly address the issue of reducing the number of legitimate emails being incorrectly blocked due to false positives related to social security numbers.
C. Increasing the minimum match count required by the DLP rule may make it more stringent in identifying social security numbers, potentially leading to more false positives and legitimate emails being blocked. This action may not be the most effective way to reduce the number of incorrectly blocked emails.
D. Lowering the confidence threshold for the DLP rule may result in more false positives being identified as social security numbers, which could lead to more legitimate emails being incorrectly blocked. This action may not effectively reduce the number of legitimate emails being blocked.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
