DLP and DNS Filtering Secure Email and Web Access
Short answer
AB Deploy DLP software to block sensitive data in corporate email and DNS filtering to restrict access to potentially harmful websites.
Question
• Preventing users from sending sensitive data over corporate email
• Restricting access to potentially harmful websites
Which of the following features should the company set up? (Choose two.)
Key Takeaways
The exam tests matching a control to its enforcement layer: DLP for email content and DNS filtering for domain reputation or category, not a generic stateful firewall.
This SY0-701 scenario asks which two controls prevent sensitive data from leaving via corporate email and restrict access to harmful websites. The correct pair is DLP software (A) for email content inspection and DNS filtering (B) for domain-level web blocking.
Common mistake: The most plausible wrong choice is D, a stateful firewall, because it sounds like a perimeter control that blocks harmful traffic; it is wrong because it enforces IP, port, and session rules and does not inspect email content or categorize websites.
Expert Analysis
Why a stateful firewall is the near-miss A stateful firewall sounds like the obvious perimeter answer because it tracks connections and can block outbound traffic. It satisfies the "restrict access" wording at a superficial level: it enforces IP, port, and session rules and can deny traffic that is not part of an allowed connection. The catch is granularity. The question does not ask to block a port or host; it asks to restrict "potentially harmful websites" by category or reputation and to stop sensitive data leaving through corporate email. A stateful firewall generally does not inspect email bodies or know that a message contains PII, and without URL filtering or a proxy it cannot classify a domain as harmful. So D is attractive but stops at the content and URL-category layer.
The email requirement maps to DLP The first bullet is content-based: sensitive data must not be sent over corporate email. DLP software (A) inspects messages and attachments against policies such as PII, financial data, or classification labels, then blocks, quarantines, encrypts, or alerts. A firewall cannot determine whether an allowed SMTP or HTTPS session carries sensitive content. This matches the reasoning in the discussion: DLP is used to stop users sending sensitive data, while a web control handles unwanted sites.
The website requirement maps to DNS filtering For the second bullet, DNS filtering (B) resolves domain requests against categories, reputation, or blocklists and refuses harmful destinations before a connection is established. That fits "restricting access to potentially harmful websites" better than a stateful firewall, which only sees address and port tuples after resolution. Antivirus signatures (F) are also tempting, but they detect known malicious files rather than blocking website categories or email exfiltration. File integrity monitoring (C) watches file changes, and guardrails (E) constrain cloud or resource configurations, not email content or web categories.
Verdict Correct answer: A and B. The paired controls satisfy one requirement each: A for sensitive email content, B for harmful website access.
Official Reference
- https://www.comptia.org/certifications/security
- https://csrc.nist.gov/glossary/term/data_loss_prevention
These links open the official vendor documentation in a new tab.
Exam Strategy
When a scenario pairs a data-type control with a web-access control, map each requirement to its primary enforcement point rather than choosing generic perimeter devices. Ask whether the control must inspect content (DLP for email) or resolve and block domains by category or reputation (DNS filtering). Treat firewalls as traffic and port enforcers and antivirus as signature-based malware detection, so neither fulfills the stated content and URL-category requirements. Use the "Choose two" count to confirm one control per bullet.
Frequently Asked Questions
Why is a stateful firewall not the right control for restricting potentially harmful websites?
How does DLP software stop sensitive data from being sent over corporate email?
Can antivirus signatures replace DNS filtering for harmful websites?
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
iliecomptia 👍 13DLP - To stop users from sending sensitive data. DNS Filtering- To block unwanted websites.
-
pchuu 👍 1How DNS Filtering Works 1. The Request: You click a link or type a website address into your browser (e.g., evil-phishing-site.com). 2. The Interception: Your computer sends a request to a DNS resolver to find that site's IP address. If your organization uses DNS filtering, that request goes to a specialized, secure DNS server (such as Cisco Umbrella or Cloudflare Gateway). 3. The Categorization: The secure DNS resolver checks the domain against a massive, real-time database of categorized websites. 4. The Verdict: • If the site is safe: The resolver returns the IP address, and your browser opens the site normally. • If the site is blocked: The resolver refuses to provide the real IP address. Instead, it redirects your browser to a safe, internal "Block Page" that explains you cannot access the site.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →