Which Solution Mitigates Sensitive Data Exfiltration Risk?

SY0-701 By islever Editorial Last updated

Given a scenario, select mitigation techniques or controls to secure an enterprise environment. Compare and contrast concepts and strategies to protect data.

Short answer

C DLP (Data Loss Prevention) monitors and blocks sensitive data from leaving the environment, directly mitigating the exfiltration risk identified after data classification.

Question

An IT manager is increasing the security capabilities of an organization after a data classification initiative determined that sensitive data could be exfiltrated from the environment. Which of the following solutions would mitigate the risk?
  1. XDR
  2. SPF
  3. DLP Correct Answer
  4. DMARC

Key Takeaways

It tests whether you can match a data-exfiltration risk to a content-aware prevention control; the trap is choosing email-authentication options like SPF or DMARC because the data may leave via email.

This SY0-701 scenario asks which solution mitigates the risk of sensitive data exfiltration after a data classification initiative. The page establishes DLP (Data Loss Prevention) as the correct answer (C), explaining why XDR, SPF, and DMARC do not directly stop sensitive data from leaving the environment.

Common mistake: The most common wrong choice is DMARC (D), because learners associate email security with data leaving the organization, but DMARC only authenticates sending domains and does not inspect or block sensitive content.

Expert Analysis

Why the Answer Is Correct

DLP (Data Loss Prevention) is purpose-built to inspect data content and enforce policies that stop sensitive information from leaving the organization. Because the data classification initiative identified what is sensitive, DLP can use those labels to monitor endpoints, network egress, cloud storage, and email for unauthorized transfers. It can alert, quarantine, or block the exfiltration attempt, which directly addresses the risk described in the scenario. In Security+ terms, DLP is the mitigation control that maps to protecting data at rest, in motion, and in use; XDR, SPF, and DMARC do not perform content-aware data blocking. The source key and the majority of learner votes both select C, and the technical reasoning supports that verdict.

Why the Other Options Are Wrong

A. XDR (Extended Detection and Response) correlates telemetry across endpoints, networks, and email to detect and respond to threats, but it is threat-centric, not data-classification-centric; it may surface exfiltration attempts but is not the primary control for enforcing sensitive-data policies. B. SPF (Sender Policy Framework) is an email sender-authentication record that reduces spoofing by listing authorized sending hosts, yet it never inspects message content or blocks sensitive attachments. D. DMARC builds on SPF and DKIM to tell receivers how to handle unauthenticated mail and to send reports, but it likewise cannot identify or prevent data loss. The learner comment from RoRoRoYourBoat selects D yet describes EDR (endpoint detection and response), which is not even an option here, showing the common confusion between email security and data-loss prevention.

Community Comment Notes

The community consensus is strongly for C, with Glacier88 stating that "specifically designed to identify and prevent the unauthorized movement of sensitive data" is the role of DLP. Justhereforcomptia adds that "DLP is the right option, it stops data from being exfiltrated from your environment." TheDorse explains that DLP can "enforce policies to prevent data from being exfiltrated," which matches the scenario's classification-driven risk. Syl0 helpfully defined XDR, SPF, DLP, and DMARC, clarifying that only DLP is a data-loss control, while Ina22 and March2023 also affirm C. The lone D vote appears to be a misread of XDR/EDR rather than a substantive argument against DLP.

Exam Strategy

In scenario questions that mention sensitive data and exfiltration, eliminate options that only authenticate email or detect threats, then choose the control that enforces data content policies. Remember DLP is the only listed option designed to identify and block classified data from leaving the environment.

Frequently Asked Questions

Why is DMARC not the right control for preventing data exfiltration?

DMARC authenticates the sending domain but does not inspect message content or block sensitive data; DLP enforces data-content policies to stop exfiltration.

How does the data classification initiative make DLP effective here?

Classification identifies which data is sensitive and where it resides, so DLP policies can monitor, alert on, or block unauthorized transfers of that specific data across endpoints, network, and cloud.

More SY0-701 FAQ →

Community Votes

C
67%
D
33%

67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. RoRoRoYourBoat 👍 2 Answered D
    Answer D: EDR is used designed to detect, investigate, and respond to advanced threats to prevent them from spreading across the network.
  2. TheDorse 👍 1 Answered C
    DLP solutions are specifically designed to monitor, detect, and prevent unauthorized data transfers or leaks outside the organization. DLP can identify sensitive data and enforce policies to prevent it from being exfiltrated, making it the most effective solution for mitigating the risk of data exfiltration.
  3. Glacier88 👍 1 Answered C
    DLP solutions are specifically designed to identify and prevent the unauthorized movement of sensitive data within and outside an organization. They can monitor data in real-time, detect suspicious activity, and take actions like blocking data transfers or alerting administrators.
  4. Syl0 👍 1
    XDR - Extended Detection and Response SPF - Sender Policy Framework - for Email to identify who can send to the domain DLP - Data Loss Prevention DMARC - similar as SPF, helps with email
  5. Justhereforcomptia 👍 1 Answered C
    DLP is the right option, it stops data from being exfiltrated from your environment.
Show 2 more comments
  1. Ina22 👍 2
    DLP is the unswer
  2. March2023 👍 1 Answered C
    C for sure

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide