DLP, Privacy, and the Data Lifecycle

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

DLP, Privacy, and the Data Lifecycle

Key Takeaways Explain This Topic AI

DLP detects and controls sensitive data movement across endpoints, email, networks, and cloud (CASB).

Privacy controls enforce lawful purpose, minimization, consent, subject rights, retention limits, and disclosure controls.

Data minimization shrinks breach impact by collecting and keeping only what a stated purpose requires.

The data lifecycle runs create, store, use, share, archive, destroy, each with its own controls.

Anonymization, pseudonymization, masking, and tokenization reduce exposure differently and are not interchangeable.

Last updated: June 2026

What DLP Does

Data Loss Prevention (DLP) is a set of technologies and policies that detect, monitor, and block sensitive data from leaving the organization improperly. On SY0-701 it appears as the answer whenever a stem describes blocking exfiltration of regulated data such as card numbers or PHI. DLP can run at four control points:

• DLP location What it monitors Example action
• Endpoint DLP Files copied to USB, screenshots, local uploads, clipboard Block copy or require justification
• Email DLP Outbound messages and attachments Quarantine, auto-encrypt, warn, or block
• Network DLP Traffic leaving monitored segments Alert on sensitive-pattern exfiltration
• Cloud DLP / CASB SaaS and cloud-storage activity and sharing Remove public link or apply label

DLP engines detect sensitive content with pattern matching (regex such as a 16-digit Luhn-valid card number), exact data matching against a fingerprinted database, document fingerprinting , dictionaries, and metadata labels. A mature program tunes rules to cut false positives and defines a response workflow for every alert. A CASB (Cloud Access Security Broker) is the specific tool for SaaS visibility and policy enforcement.

Privacy Principles and Regulations

• Term Meaning
• Data minimization Collect and keep only what the stated purpose needs
• Purpose limitation Use data only for the approved reason
• Consent User permission where law or policy requires it
• Data subject rights Access, correction, deletion (right to be forgotten), portability
• Right to be forgotten Erasure of personal data on valid request (GDPR Art. 17)
• Retention How long data is kept before archive or disposal

Know the headline regulations: GDPR (EU; breach notification within 72 hours; fines up to 4% of global annual revenue), CCPA/CPRA (California consumer rights), HIPAA (US health PHI), and PCI DSS (payment card data — an industry standard, not a law).

Reducing Exposure

These four obfuscation techniques look similar but the exam distinguishes them sharply.

• Technique What it does Reversible? Example
• Masking Hides part of a displayed value Display-only; data still stored Show only last four card digits

Tokenization Replaces a value with a non-mathematical reference token; real value held in a separate vault Yes, via the vault Payment token in app database

Pseudonymization Replaces identifiers; can be re-linked with additional data Yes, with the key/mapping Research ID mapped to a patient

Anonymization Removes identifiers so re-identification is not reasonably possible No Aggregated statistics

Key distinctions: masking changes only what is shown ; tokenization removes the real value from the system entirely (valuable for PCI scope reduction); pseudonymized data is still personal data under GDPR because it can be re-linked, while truly anonymized data falls outside it.

The Data Lifecycle

• Stage Security focus
• Create / collect Notice, purpose, consent, classification, minimization
• Store Access control, encryption, logging, approved location
• Use Least privilege, masking, monitoring, purpose limits
• Share Agreements, approval, secure transfer, DLP checks
• Archive Retention schedule, legal hold, periodic access review
• Destroy Secure erase, shredding, crypto-shredding, certificate of destruction
• Worked Scenario

Marketing asks to export the full customer database to test a new campaign tool. The correct Security+ answer is rarely "send everything." Confirm the business purpose, share only the minimum fields, strip or tokenize unnecessary identifiers, route the file to an approved vendor under a data-processing agreement, apply a retention limit, log access, and schedule deletion after testing. That single answer chains minimization, purpose limitation, and lifecycle disposal.

Common Exam Traps

"DLP is only a network tool" — it also covers endpoint, email, and cloud/CASB.

"Masking and encryption are the same" — masking alters display; encryption transforms data with a key.

"Keep all logs forever" — retention balances legal, operational, privacy, and cost factors.

"Anonymized data can always be re-linked" — proper anonymization is designed to prevent reasonable re-identification, unlike pseudonymization.

Quick Drill

Stop users emailing restricted spreadsheets externally → email DLP.

Let an agent verify a card without seeing the full number → masking.

Avoid storing real card numbers in the app → tokenization.

Auto-delete cloud objects after seven years unless on legal hold → lifecycle/retention policy.

Keep data inside an approved country → data residency control.

Owner, Controller, and Processor in Privacy Law

Privacy regulations add roles beyond the generic data owner. The data controller decides why and how personal data is processed and bears primary legal accountability; the data processor acts only on the controller's documented instructions, typically a cloud or SaaS vendor bound by a data-processing agreement. When a breach occurs at a processor, the controller still owes the subjects notice and remediation.

Exam stems that mention a third-party SaaS handling customer records are usually pointing at the controller/processor distinction, and the correct contractual control is a signed processing agreement plus due-diligence review of the vendor's safeguards.