Question 1

DLP would be used to detect an employee who is emailing a customer list to a personal account before leaving the company.

Data Loss Prevention (DLP) technologies are specifically designed to monitor and protect sensitive information from being transmitted outside of an organization's network, making it the optimal choice for detecting unauthorized sharing of customer lists via email.

A) DLP

DLP is explicitly created to prevent sensitive information from being shared inappropriately. It can identify and block attempts to email confidential data, such as customer lists, to external accounts, thereby safeguarding the organization's proprietary information.

B) FIM

File Integrity Monitoring (FIM) is focused on detecting changes to files within a system, ensuring that unauthorized modifications are reported. However, FIM does not monitor email communications or data exfiltration, making it unsuitable for detecting the act of emailing customer lists.

C) IDS

Intrusion Detection Systems (IDS) are designed to monitor network traffic for suspicious activities and potential intrusions. While they can alert on various traffic patterns, they are not specifically tailored to identify data leaks or the unauthorized emailing of sensitive information, such as customer lists.

D) EDR

Endpoint Detection and Response (EDR) focuses on monitoring and responding to threats on endpoints like computers and servers. Although EDR solutions can provide insights into endpoint activities, they are not primarily designed for preventing or detecting the sending of sensitive data via email.

Conclusion

DLP is the most effective tool for preventing unauthorized data sharing, particularly in the context of emailing sensitive information like customer lists. Other options, such as FIM, IDS, and EDR, do not adequately address the specific need to monitor and restrict the transfer of confidential data outside the organization, thus making them ineffective in this scenario.