I85PREP
⌘ K
Forcepoint DLP Admin study materials
Forcepoint DLP Admin study resources

Forcepoint DLP Admin: Forcepoint DSPM: Discovery, Classification, Risk and Remediation

Forcepoint DLP Admin · Work through your exam, one topic at a time.

All guide sections

Forcepoint DSPM: Discovery, Classification, Risk and Remediation

Forcepoint DSPM answers a different question from DLP: not 'is data leaving?' but 'where does our sensitive data sit, who can reach it, and how damaging would a leak be?' It is agentless, connector-driven data security posture management across SaaS and cloud storage. The exam tests the loop discovery, classification, exposure and risk scoring, remediation, plus the vocabulary that separates a DSPM finding from a DLP incident.

Core concepts

  • Agentless connectors are read-only API integrations pulling metadata and content samples from M365 (SharePoint, OneDrive, Teams), Google Workspace, Salesforce, AWS S3, Azure Blob, and similar repositories.
  • Classification uses AI/ML models plus pattern and dictionary classifiers to tag PII, PHI, PCI, credentials, and intellectual property, including in unstructured files that carry no label.
  • Dark data: sensitive content that is unclassified, unowned, or never accessed - nobody is accountable for it.
  • Shadow data: copies or exports living outside the sanctioned repository - a stale share, a personal drive, a forgotten bucket.
  • Exposure is derived from permissions: anonymous links, 'Everyone except external users', broad groups, inherited access, public buckets.
  • Risk scoring combines sensitivity, exposure breadth, volume, and ownership gaps, producing a data risk score that drives prioritisation rather than raw file counts.
  • Remediation removes public links, corrects permissions, assigns data owners, applies sensitivity labels, or quarantines, and can feed policy into DLP.

Worked example

A SharePoint site shared with 'Everyone except external users' holds 12,000 files, 400 of which contain identity documents. Reasoning: the connector enumerates the site; classifiers flag the 400 PII files; exposure logic marks the anonymous-scope link as high risk; ownership lookup returns no active owner, raising the score; volume amplifies it. Remediation is not 'delete the site' - it is restricting the link to the project group, assigning an owner, applying the Confidential label, and opening a task with a due date. Residual risk is re-measured on the next scan.

Traps

  • Expecting DSPM to block a transfer in real time - enforcement belongs to DLP or CASB; DSPM discovers, scores, and remediates at rest.
  • Reading 'agentless' as 'no permissions' - connectors need broad read scope, which is itself a governance question.
  • Counting files instead of weighting exposure and sensitivity.
  • Mixing up dark data (unknown or unowned) with shadow data (copies outside sanctioned stores).
  • Assuming a label applied here replaces DLP policy; labels inform policy, they do not enforce it.