How should data loss prevention (DLP) controls be audited to prevent data exfiltration?

• A. Rely solely on encryption in transit to stop exfiltration.
• B. Audit only the user access credentials of DLP administrators.
• C. Review DLP policy and enforcement, endpoint and network coverage, alerting effectiveness, data classification, incident handling, and testing of false positives/negatives.
• D. Implement DLP without policy documentation or testing.

Answer: (C)

Auditing DLP controls to prevent data exfiltration hinges on validating governance, coverage, and ongoing validation. Start by checking that there is a clear DLP policy tied to data classification, with rules that specify what data cannot be transmitted and through which channels. Then verify enforcement and coverage: DLP should be deployed across endpoints, email gateways, cloud services, and network devices, and it must monitor all relevant data paths—data in use, in transit, and at rest. Next assess alerting and response: alerts should be timely and actionable, integrated with the security incident response process, and supported by defined playbooks and escalation steps. Then review incident handling: how incidents are investigated, contained, remediated, and how evidence is preserved for post-incident analysis. Finally, emphasize testing and validation: regularly test DLP rules to measure false positives and false negatives, run simulated exfiltration scenarios, and track metrics such as detection rate, response time, and containment effectiveness. When these areas are covered, the audit provides assurance that DLP controls are effectively preventing exfiltration across data paths and usage scenarios. Relying solely on encryption in transit misses data at rest and insider-threat scenarios and does not verify enforcement; auditing only administrator credentials ignores the broader control environment; implementing DLP without documented policy or testing creates governance gaps and unmeasured risk.