Domain 2 of 6 · Chapter 4 of 8

Data Discovery

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Certified Cloud Security Professional premium course — no separate purchase.

Included in this chapter:

  • Discovery before classification: find it, then label it
  • Three data structures, three discovery techniques
  • The three discovery approaches: metadata, labels, content
  • Data location tracking
  • Exam-pattern recognition

Data structure types and how you discover each

AspectStructuredSemi-structuredUnstructured
SchemaFixed, predefined (tables, typed columns)Self-describing tags/markers, no rigid schemaNo inherent schema
Typical storesRelational DBs, data warehousesJSON/XML, log files, NoSQL document storesObject/file storage: documents, images, PDFs, email
Primary discovery techniqueScan schema, column names, data types, sample rowsParse keys/tags and element valuesInspect file contents (text extraction, OCR, ML)
Relative cost/difficultyLowestModerateHighest
Estimated share of enterprise dataSmallest portionGrowing portionLargest portion (often cited ~80%)

Decision tree

Discovery goal?match data, or pick approachby data formatby accuracy / cost needHow is the data structured?tablestags/keysno schemaStructured:scan schemaSemi-struct:parse tags+ keysUnstructured: inspect contenttext extraction, OCR, MLNeed to catch hidden /mislabeled data?yes, be authoritativeno, fast first passContent-based discoveryonly one that finds untaggedMetadatafast, cheapMust data stay in a jurisdiction?residency or sovereignty ruleyesAdd location tracking + region pinningrecord every copy's region by contract + configAlways: run discovery on a schedule (recurring control), then classify what you found.
Cheat sheet

Cheat sheet

  • Discover data before you classify it
  • Treat discovery as a recurring control, not a one-time project
  • Match the discovery technique to the data's structure
  • Structured data is discovered by scanning the schema
  • Unstructured data has no schema, so you must inspect its content
  • Semi-structured data carries tags but no rigid schema
  • Data structure describes format, not sensitivity
  • Three discovery approaches: metadata, labels, content
  • Metadata-based discovery is fast but only as honest as the metadata
  • Label-based discovery is blind to whatever was never labeled
  • Content-based discovery is the only approach that catches untagged or mislabeled data
  • Content discovery and DLP share an engine but do different jobs
  • Layer the three approaches to keep the costly content pass focused
  • Location tracking is part of discovery, because the law follows the bytes
  • The cloud creates copies you must still track
  • A location record names the service, region, jurisdiction, and copy type
  • Discovery finds; classification, IRM, and DLP each do something else

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. What is Amazon Macie? — automated sensitive data discovery
  2. Data classification in Microsoft Purview Data Map
  3. Sensitive Data Protection discovery (data profiles) — Google Cloud