To restrict copying files only to a specific set of organization-owned USB drives, which detection method should be used?

To restrict copying files only to a specific set of organization-owned USB drives, which detection method should be used?

• A. Described Content Matching (DCM)
• B. Descriptive File Tagging
• C. Content Discovery
• D. Hash Matching

Answer: (A)

Described Content Matching focuses on the description attached to the data itself to drive enforcement. With DCM, you define a description or metadata for the sensitive content and create a policy that ties that description to allowed handling, such as only permitting copies to a predefined set of organization-owned USB drives. When a copy attempt is made, the DLP system checks the described content against the policy and authorizes the transfer only if the destination matches the approved device list; otherwise, it blocks the action. This approach directly supports device-bound restrictions by using the data’s descriptor to govern where it can go. Hash matching would only block known files based on their exact hash, regardless of the destination. Content discovery identifies where data resides but doesn’t enforce flow restrictions to specific devices. Descriptive file tagging involves tagging data for policy handling but requires additional policy logic to enforce device restrictions; DCM already provides the mechanism to describe data and its allowed destinations within a single enforcement rule.

Described Content Matching focuses on the description attached to the data itself to drive enforcement. With DCM, you define a description or metadata for the sensitive content and create a policy that ties that description to allowed handling, such as only permitting copies to a predefined set of organization-owned USB drives. When a copy attempt is made, the DLP system checks the described content against the policy and authorizes the transfer only if the destination matches the approved device list; otherwise, it blocks the action. This approach directly supports device-bound restrictions by using the data’s descriptor to govern where it can go.

Hash matching would only block known files based on their exact hash, regardless of the destination. Content discovery identifies where data resides but doesn’t enforce flow restrictions to specific devices. Descriptive file tagging involves tagging data for policy handling but requires additional policy logic to enforce device restrictions; DCM already provides the mechanism to describe data and its allowed destinations within a single enforcement rule.