CAS-004 Exam - Question 480

Question

An employee in the accounting department created a potential security incident by emailing an internal spreadsheet to an external email address. The spreadsheet contained thousands of payment card numbers. A security administrator queried the following filter log and filter policy settings:

Outbound filter log information for the email:

Outbound filter policy settings:

Which of the following would best prevent this scenario from reoccurring without causing disruptions to normal business operations?

Examice · Accepted Answer

The best answer is to change the Filter action for Card_Data_Policy from Allow to Quarantine. This option addresses the specific issue of an email containing payment card numbers being sent externally. Quarantining these emails ensures they are reviewed before leaving the organization's network, which effectively prevents unauthorized external sharing of sensitive information without significantly disrupting normal business operations. The other options either do not specifically address this issue, or they may cause unnecessary disruptions.

isaphiltrick · Answer

Is this a one or two answer question?  Almost all previous questions with 6 or more questions were multiple answers.

If one answer, I choose B. Change the Filter action for Card_Data_Policy from Allow to Quarantine.

If two-answers are required, I choose B. Change the Filter action for Card_Data_Policy from Allow to Quarantine and D. Change the Filter action for all Attachment_Policy from Allow to Block.

armid · Answer

If this is single answer question i would say A. Sensitive policy is already in block mode but not included in the filter log. We are modifying the data sensitivity labels and not the existing policies, which sounds in line with "least disruptions" to me.
B offers itself, but the clause "without disruptions to normal business operations" makes me sway towards A. Plus we are judging the policy just by its name.
If two answer question then A+B
C doesn't apply because it could be disruptive
D would be super disruptive
E doesn't qualify as nowhere in the question is stated that the external mail is personal
F doesn't qualify as it is just monitor and action would be taken too late

armid · Answer

my previous answer is incorrect

23169fd · Answer

Quarantining emails containing payment card data would prevent them from being sent without review, which is effective but could disrupt normal operations by delaying email delivery.

EAlonso · Answer

C. It could look disruptive, but comparing Sensitive_Policy actions are higher than Confidential_Policy, and credit card information is Confidential in any context.
https://www.recordpoint.com/blog/a-guide-to-data-classification-confidential-vs-sensitive-vs-public-information
https://www.recordpoint.com/blog/a-guide-to-data-classification-confidential-vs-sensitive-vs-public-information

EAlonso · Answer

Well, no other more than B.

CAS-004 Exam - Question 480

Discussion