CCSP - Cloud Data Security (20% of the exam) - Section 2.4
Implement data discovery.
Structured, unstructured and semi-structured data discovery, and data location and mapping across jurisdictions and services.
structured data discoveryunstructured data discoverydata location and residencycontent analysis
Practice question for this objective
lock_openFree sampleCloud Data Securitymedium
A cloud data security team must run discovery across two stores: a managed relational database with defined tables and columns, and an object storage bucket holding scanned PDFs, images and free-text notes. Which statement about the discovery techniques best distinguishes structured from unstructured data discovery?
AStructured discovery relies on content analysis of the raw bytes, whereas unstructured discovery reads the schema catalogue to locate sensitive fields.
BBoth structured and unstructured discovery depend solely on file names and storage paths, so the technique is identical for the database and the bucket.
CStructured discovery is only possible after the data has been encrypted, whereas unstructured discovery works only on plaintext held in object storage.
DStructured discovery can query the defined schema to find sensitive columns, whereas unstructured discovery must parse and analyse the content itself because no schema describes it.check_circle Correct
Distinguish structured data discovery, which queries a known schema, from unstructured discovery, which must analyse content directly. Structured stores publish table and column metadata, so discovery tools locate sensitive fields by interrogating the schema. Unstructured stores such as documents and images carry no schema, so their sensitivity can only be established by parsing and analysing the content itself.
Why A is wrong: This inverts the two techniques. Content analysis is what unstructured stores require because they have no schema, so attributing it to the relational database and giving the schema catalogue to the PDFs is backwards.
Why B is wrong: Names and paths are a weak hint at best and are unreliable for either store; discovery in both cases inspects the data or its schema, so claiming the techniques are identical and path-based is wrong.
Why C is wrong: Encryption state is not what separates the two techniques; discovery generally needs readable data or schema, so tying structured discovery to prior encryption misstates the mechanism.
Why D is correct: Correct: a relational store exposes tables and column metadata that discovery can query directly, while objects such as PDFs and free text have no schema, so their sensitivity must be inferred by analysing the content.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
Data classification, the assignment of a sensitivity level such as confidential or public to the records.
errorWhy it is wrong: Classification describes how sensitive the data is, not where it is stored; the finding about physical countries is about location, so classification is the wrong concept.
Label-based discovery, which trusts existing metadata tags and column headings to decide what is sensitive without reading the values.
errorWhy it is wrong: This is tempting because labels are quick to read, but the scenario explicitly wants classification regardless of the heading, and label-based discovery fails exactly where a heading is missing or wrong.
Metadata-based discovery that reads each object's tags, storage class and creation date to flag files that were never classified
errorWhy it is wrong: Metadata discovery is fast and useful for labelled assets, but these free-text files were never tagged, so scanning metadata alone would miss card numbers buried inside the file bodies.