Data Loss Prevention (DLP) systems are specifically designed to detect and prevent unauthorized data transfers. In the context of an insider threat, where a bank employee attempts to exfiltrate sensitive information via email, DLP solutions are most effective because they:

Monitor Data in Motion: DLP can inspect outgoing emails for sensitive content based on pre-defined rules and policies.

Content Inspection and Filtering: It examines email attachments and the body of the message for patterns that match sensitive data (like financial records or PII).

Real-Time Alerts: Generates alerts or blocks the transfer when sensitive data is detected.

Granular Policies: Allows customization to restrict specific types of data transfers, including via email.

Other options analysis:

B . Intrusion detection system (IDS): IDS monitors network traffic for signs of compromise but is not designed to inspect email content or detect data exfiltration specifically.

C . Network segmentation: Reduces the risk of lateral movement but does not directly monitor or prevent data exfiltration through email.

D . Security information and event management (SIEM): SIEM can correlate events and detect anomalies but lacks the real-time data inspection that DLP offers.

CCOA Official Review Manual, 1st Edition Reference:

Chapter 5: Insider Threats and Mitigation: Discusses how DLP tools are essential for detecting data exfiltration.

Chapter 6: Threat Intelligence and Analysis: Covers data loss scenarios and the role of DLP.

Chapter 8: Incident Detection and Response: Explains the use of DLP for detecting insider threats.