CRISC Question 218

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C2

  C. Testing the transmission of credit card numbers The best way to ensure the effectiveness of a DLP control, especially one that's intended to prevent the loss of sensitive data like credit card numbers, would be to test the system by attempting to transmit credit card numbers. If the system works as intended, it should detect and block such attempts, thereby proving its effectiveness. A. While reviewing logs for unauthorized data transfers is an important activity for overall security, it does not proactively test the DLP control's ability to prevent loss of credit card data. B. Configuring the DLP control to block credit card numbers is a necessary setup step, but it doesn't ensure the effectiveness of the control. The effectiveness can only be ensured by testing. D. Testing the DLP rule change control process could be important to ensure changes to rules are properly managed, but it does not directly validate the effectiveness of the DLP control in preventing the loss of credit card data.

• Chose A1

  Agree "A" the best answer

• Chose C1

  Generally, the effectiveness of a control is checked by testing it. Option 'A' simply talks about 'data transfers'.