Question

A financial services firm is designing a data security architecture that spans Microsoft 365, an on-premises file server, and an AWS S3 data lake used for analytics. Regulators require that once a document is labeled 'Restricted,' the classification and its associated protections must remain enforced regardless of where the file is moved, copied, or downloaded. The security architect must select an approach that ensures the label and its protection travel with the data across all three environments. Which approach best meets this requirement?

Accepted Answer

Apply sensitivity labels that embed persistent metadata and enforce encryption/usage rights within the file itself, integrated with the DLP and rights-management service across all platforms

Answer

Configure S3 bucket policies and NTFS ACLs to restrict access to Restricted files based on the storage location

Answer

Deploy a network DLP appliance at the perimeter to block Restricted files from leaving the corporate network

Answer

Maintain a central classification register that maps file hashes to their classification level for auditing purposes