The correct answer is Exact file fingerprinting using hashes.

Exact file fingerprinting using hashes generates a cryptographic digest of the entire file and compares those digests to recognize identical files. Cryptographic hash functions are designed for collision resistance so the probability of two different files producing the same digest is negligible. That collision resistance is what allows exact file fingerprinting to detect complete sensitive documents leaving the network even when filenames or metadata change.

Conceptual lexicon and pattern lists rely on keyword lists and contextual rules to find sensitive content and they do not use cryptographic hashes. They are useful for term based detection but they cannot reliably detect exact file copies.

Cloud DLP API is an interface to a service and not the specific hash based method described in the question. The API may offer multiple detection techniques but invoking the API is not itself the collision resistant hashing approach the question asks about.

Database fingerprinting typically fingerprints structured records or fields rather than producing whole file cryptographic hashes. It is focused on database row or column data and not on file level exact matches for document exfiltration detection.

Rule based detection using regexes and patterns searches for textual patterns and formats and it can generate false positives or false negatives for whole file detection. Regex and pattern rules do not depend on collision resistant cryptographic hashing and so they are not the method the question describes.

Full AWS Practitioner Certification Question