The correct option is Inspecting data flows and applying filters to traffic that match predefined patterns.

Inspecting data flows and applying filters to traffic that match predefined patterns is how Data Loss Prevention systems detect sensitive information because they analyze content and contextual metadata as it moves. They use pattern matching and fingerprints to recognize credit card numbers, personal data, intellectual property, and other sensitive items and then apply policies to block, quarantine, encrypt, or alert on that traffic.

These systems operate at endpoints, gateways, and cloud controls and they can inspect files, email, web uploads, and other channels. They often combine content inspection with contextual checks such as sender, recipient, and destination to reduce false positives while enforcing prevention actions.

Relying on endpoint backups and internal archives is incorrect because backups and archives are for data recovery and retention rather than preventing data from leaving the organization. They do not stop exfiltration in real time.

Placing a gateway that performs intrusion detection for all network traffic is incorrect because intrusion detection is focused on detecting attack patterns and anomalies rather than inspecting content for sensitive data and enforcing data handling policies.

Validating every input at application boundaries before processing is incorrect because input validation helps prevent malformed or malicious input but it does not identify or stop the leakage of existing sensitive information as it traverses networks or leaves systems.

Full AWS Practitioner Certification Question