Data Loss Prevention (DLP)

Data Loss Prevention (DLP) inspects content, identifies sensitive data by pattern matching, fingerprinting, or data classification labels, and enforces policy on what may leave the organisation. When a user tries to email a customer database or copy source code to a USB stick, DLP can block the action, strip or quarantine the content, or alert the security team while logging the attempt.

DLP comes in three deployments, and questions often turn on choosing the right one. Network DLP sits at egress points and inspects outbound traffic. Endpoint DLP runs on the device itself and controls channels a network sensor never sees: USB storage, clipboard, print, and screenshots. Discovery DLP scans data at rest to find sensitive material stored where it should not be. All three depend on classification: DLP enforces the labels and definitions the organisation has already made, and an unclassified estate gives it nothing to enforce.

Exam relevance: if a scenario describes stopping the exfiltration of known sensitive content, the answer is DLP; if the leak channel is a USB stick or clipboard, the answer is endpoint DLP specifically. The nearest confusable is egress monitoring, the broader practice of watching outbound traffic: DLP is one enforcement technology within it, distinguished by content awareness and the ability to block rather than just observe.