Which Solution Mitigates Sensitive Data Exfiltration Risk?
An IT manager is increasing the security capabilities of an organization after a data classification initiative determined that sensitive data could be exfiltrated from the environment. Which of the following solutions would mitigate the risk?
Community Votes
67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
It tests whether you can match a data-exfiltration risk to a content-aware prevention control; the trap is choosing email-authentication options like SPF or DMARC because the data may leave via email.
This SY0-701 scenario asks which solution mitigates the risk of sensitive data exfiltration after a data classification initiative. The page establishes DLP (Data Loss Prevention) as the correct answer (C), explaining why XDR, SPF, and DMARC do not directly stop sensitive data from leaving the environment.
The most common wrong choice is DMARC (D), because learners associate email security with data leaving the organization, but DMARC only authenticates sending domains and does not inspect or block sensitive content.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
DLP (Data Loss Prevention) is purpose-built to inspect data content and enforce policies that stop sensitive information from leaving the organization. Because the data classification initiative identified what is sensitive, DLP can use those labels to monitor endpoints, network egress, cloud storage, and email for unauthorized transfers. It can alert, quarantine, or block the exfiltration attempt, which directly addresses the risk described in the scenario. In Security+ terms, DLP is the mitigation control that maps to protecting data at rest, in motion, and in use; XDR, SPF, and DMARC do not perform content-aware data blocking. The source key and the majority of learner votes both select C, and the technical reasoning supports that verdict.Why the Other Options Are Wrong
A. XDR (Extended Detection and Response) correlates telemetry across endpoints, networks, and email to detect and respond to threats, but it is threat-centric, not data-classification-centric; it may surface exfiltration attempts but is not the primary control for enforcing sensitive-data policies. B. SPF (Sender Policy Framework) is an email sender-authentication record that reduces spoofing by listing authorized sending hosts, yet it never inspects message content or blocks sensitive attachments. D. DMARC builds on SPF and DKIM to tell receivers how to handle unauthenticated mail and to send reports, but it likewise cannot identify or prevent data loss. The learner comment from RoRoRoYourBoat selects D yet describes EDR (endpoint detection and response), which is not even an option here, showing the common confusion between email security and data-loss prevention.Community Comment Notes
The community consensus is strongly for C, with Glacier88 stating that "specifically designed to identify and prevent the unauthorized movement of sensitive data" is the role of DLP. Justhereforcomptia adds that "DLP is the right option, it stops data from being exfiltrated from your environment." TheDorse explains that DLP can "enforce policies to prevent data from being exfiltrated," which matches the scenario's classification-driven risk. Syl0 helpfully defined XDR, SPF, DLP, and DMARC, clarifying that only DLP is a data-loss control, while Ina22 and March2023 also affirm C. The lone D vote appears to be a misread of XDR/EDR rather than a substantive argument against DLP.Exam Strategy
In scenario questions that mention sensitive data and exfiltration, eliminate options that only authenticate email or detect threats, then choose the control that enforces data content policies. Remember DLP is the only listed option designed to identify and block classified data from leaving the environment.
Frequently Asked Questions
Why is DMARC not the right control for preventing data exfiltration?
DMARC authenticates the sending domain but does not inspect message content or block sensitive data; DLP enforces data-content policies to stop exfiltration.
How does the data classification initiative make DLP effective here?
Classification identifies which data is sensitive and where it resides, so DLP policies can monitor, alert on, or block unauthorized transfers of that specific data across endpoints, network, and cloud.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →