The question asks for the best technical method to protect sensitive data at an organizational level. Among the options, Data Loss Prevention (DLP) is explicitly a technical control category designed to prevent sensitive data leakage/exfiltration across the organization, especially at network boundaries (egress points) and via endpoints.
Why DLP (Option D) is best:
DLP is built specifically to stop sensitive data from leaving where it should be contained (data exfiltration/leakage prevention) and can be applied broadly across the enterprise (network + endpoints). The Sybex CySA+ Study Guide defines DLP this way:Exact extract (Sybex Study Guide): “DLP systems and software work to protect data from leaving the organization…”
DLP is commonly implemented at network egress points (and also endpoints), which aligns directly with “egress and ingress” monitoring in the option wording. The Secbay Press guide reinforces this deployment model:Exact extract (Secbay Press): “Network DLP… Installed at network egress points near the perimeter”
DLP is also a key technique to help detect/prevent data exfiltration, which is a major concern for sensitive data protection programs:Exact extract (All-in-One Exam Guide): “Implement DLP tools to detect and prevent sensitive data from being transferred outside the organization.”
Finally, DLP is explicitly part of the CS0-003 exam objectives under Sensitive data protection, making it the most “officially aligned” technical method in the answer choices:Exact extract (CompTIA CS0-003 Objectives): “Sensitive data protection – Data loss prevention (DLP)”
Why the other options are not “best”:
A (Block port 8080 / VLAN): Too narrow and mis-scoped. Port-based blocking doesn’t reliably stop sensitive data movement (data could leave on 443/HTTPS, email, cloud apps, etc.). Also, “traffic on port 8080 with sensitive information” is not how traffic filtering is normally expressed and isn’t an enterprise-wide sensitive data protection strategy.
B (Python script for email PII): Helpful as a tactical control, but limited to email only, brittle to evasion/encryption, and not an enterprise-wide standardized control like DLP. (Also corrected typo: “Pll” → PII.)
C (Restrictive policy): A policy is an administrative/managerial control, not a technical method. The question explicitly asks for the best technical method.
References (CompTIA CySA+ CS0-003 documents / study guides used):
Mike Chapple & David Seidl, CompTIA CySA+ Study Guide (CS0-003): DLP “protect[s] data from leaving the organization…”
Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003): Network DLP at egress points
Mya Heath et al., CompTIA CySA+ All-in-One Exam Guide (CS0-003): DLP helps “detect and prevent sensitive data” transfer outside
