CCSP - Cloud Data Security - Section 2.6

Design and implement Information Rights Management (IRM).

IRM objectives, and appropriate tools such as issuance and revocation of certificates, persistent protection travelling with the object, and provisioning of rights.

Information Rights Managementdigital rights managementcertificate issuance and revocationpersistent protection

Practice question for this objective

Free sampleCloud Data Securitymedium

An Information Rights Management (IRM) solution is described as providing 'persistent protection'. Which statement best captures what persistent protection means for a protected document?

  • AThe document is kept permanently encrypted at rest inside the content repository and is decrypted only while a user has it open on screen.
  • BA full audit log of every open, edit and print is retained indefinitely so that access can be reconstructed at any later date.
  • CThe rights policy is cached on the endpoint so the file can still be opened after the licence server is decommissioned.
  • DAccess controls and usage rights travel inside the file itself, so they continue to be enforced after the file leaves the repository or is copied elsewhere. Correct
Explain that IRM persistent protection binds usage policy and encryption to the object so controls are enforced wherever the file travels. IRM embeds encryption and a machine-readable rights policy into the object and evaluates that policy at the point of use, so protection is a property of the file rather than of the repository, and it survives copying, emailing or download.

Why A is wrong: This describes repository encryption at rest, which protects only while the file stays in the store; it is tempting but persistence means the policy travels with the file after it leaves.

Why B is wrong: IRM does log usage, but persistent protection refers to enforcement travelling with the object, not to how long audit records are kept.

Why C is wrong: This confuses persistence with permanent offline availability; IRM typically still requires policy or key validation, and removing the server usually revokes access rather than guaranteeing it.

Why D is correct: Persistent protection binds encryption and a rights policy to the object, so controls follow the file wherever it goes rather than depending on the store it came from.

See more CCSP practice questions, answers explained.

More in this domain

Back to all Cloud Data Security objectives, or the CCSP cert hub.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.