Deploy an endpoint detection and response platform with continuous monitoring and automated remediation is the most effective approach to reduce the chance of sensitive information being exposed from endpoints.

Deploy an endpoint detection and response platform with continuous monitoring and automated remediation provides continuous visibility into endpoint activity and can detect suspicious behaviors that indicate data theft or compromise. It can identify malicious processes, unusual network connections, and data staging on devices and it can trigger automated actions such as isolating a device, killing a process, or rolling back changes to stop exfiltration quickly.

Deploy an endpoint detection and response platform with continuous monitoring and automated remediation reduces the window of exposure because it focuses on detection and response at the endpoint where encryption of data at rest or in transit does not prevent misuse of data while a device is active. It also complements preventative controls and can feed indicators to other security tools for coordinated containment.

Enroll devices in a mobile device management program and enforce configuration and access policies is helpful for enforcing security settings and controlling access, but it is primarily preventive and policy driven. It does not by itself provide the continuous behavioral detection and automated containment that is needed to stop active exfiltration from compromised endpoints.

Enable full disk encryption on all company laptops and phones protects data at rest if a device is lost or stolen, but it does not prevent or detect data being copied or transmitted while the device is in use by an attacker or a malicious insider. Encryption at rest is important but it does not address live exfiltration risks.

Apply an endpoint data loss prevention solution to detect and block sensitive data exfiltration can detect patterns of sensitive data leaving endpoints and it can block some exfiltration methods. However DLP solutions can be bypassed, they often require extensive tuning, and they do not typically provide the same level of forensic visibility and automated remediation actions that an EDR platform provides. Combining DLP with EDR gives stronger protection, but EDR is the most effective single choice for detection and response.

Full AWS Practitioner Certification Question