Cloud Data Loss Prevention is the correct option for discovering confidential data that has been stored without authorization on workstation hard disks.

Cloud Data Loss Prevention is designed to find and classify sensitive information in files and stored data and it can scan content at rest through connectors or APIs. It uses pattern matching dictionaries and machine learning to detect personal data credentials and other confidential items and it can also help redact or transform data to support remediation when unauthorized storage is found.

Cloud Armor protects applications from DDoS attacks and provides web application firewall features. It focuses on filtering and blocking malicious traffic and it does not perform content discovery or file system scanning on disks.

Transport Layer Security provides encryption and integrity for data while it is transmitted across networks. It secures communication channels and prevents eavesdropping but it does not locate or classify confidential data at rest on workstation drives.

Cloud IDS monitors network traffic to detect intrusions and anomalous behavior. It analyzes packets and flows for threats and it is not intended to scan file contents or discover sensitive data stored on disk.

Full AWS Practitioner Certification Question