Exam CISA topic 1 question 1786 discussion

Generate alerts but do not block, and adjust policies and rules based on actual data → most effective in minimizing false positives

ey Supporting Evidence: Hemang Doshi CISA-Certified IS Auditor Study Guide 3rd-ed: "The effectiveness of a DLP solution primarily depends on DLP configuration." "The primary responsibility for reviewing and investigating DLP alerts typically falls to the data owners," implying rule customization based on organizational context. "Implementing a DLP solution in phases... helps with identifying and resolving configuration issues." Thus, configuring a limited, context-specific rule set (Option D) directly addresses false positives by refining detection logic to match the organization’s unique requirements.

B. Deploying the tool in monitor mode. By deploying the DLP tool in monitor mode, the organization can observe and fine-tune its performance without actively blocking actions. This allows for the adjustment of rule sets and detection points based on real-world data and behavior, reducing false positives before the tool is fully enforced. Using default rules or reducing detection points could miss actual incidents, and configuring a limited set of rules may not cover all relevant risks.