CCSP - Cloud Data Security (20% of the exam) - Section 2.6
Design and implement Information Rights Management (IRM).
IRM objectives, and appropriate tools such as issuance and revocation of certificates, persistent protection travelling with the object, and provisioning of rights.
Information Rights Managementdigital rights managementcertificate issuance and revocationpersistent protection
Practice question for this objective
lock_openFree sampleCloud Data Securitymedium
An Information Rights Management (IRM) solution is described as providing 'persistent protection'. Which statement best captures what persistent protection means for a protected document?
AThe document is kept permanently encrypted at rest inside the content repository and is decrypted only while a user has it open on screen.
BA full audit log of every open, edit and print is retained indefinitely so that access can be reconstructed at any later date.
CThe rights policy is cached on the endpoint so the file can still be opened after the licence server is decommissioned.
DAccess controls and usage rights travel inside the file itself, so they continue to be enforced after the file leaves the repository or is copied elsewhere.check_circle Correct
Explain that IRM persistent protection binds usage policy and encryption to the object so controls are enforced wherever the file travels. IRM embeds encryption and a machine-readable rights policy into the object and evaluates that policy at the point of use, so protection is a property of the file rather than of the repository, and it survives copying, emailing or download.
Why A is wrong: This describes repository encryption at rest, which protects only while the file stays in the store; it is tempting but persistence means the policy travels with the file after it leaves.
Why B is wrong: IRM does log usage, but persistent protection refers to enforcement travelling with the object, not to how long audit records are kept.
Why C is wrong: This confuses persistence with permanent offline availability; IRM typically still requires policy or key validation, and removing the server usually revokes access rather than guaranteeing it.
Why D is correct: Persistent protection binds encryption and a rights policy to the object, so controls follow the file wherever it goes rather than depending on the store it came from.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
Rotate the shared-folder link and disable the partner's SaaS account when the contract ends
errorWhy it is wrong: Disabling the account and rotating links stops new retrievals, but copies the partner already downloaded stay readable because nothing binds usage rights to the file itself.
It inspects traffic at network egress points and blocks files that match sensitive content patterns before they leave the perimeter.
errorWhy it is wrong: Content inspection at egress is the classic DLP function; it acts at a boundary and does not control the file once it has passed, so it is not the IRM-distinctive trait.
Issue certificates with no expiry and rely on disabling the contractor's directory account on departure
errorWhy it is wrong: Disabling the directory account stops new authentications, but a never-expiring certificate already cached on the device continues to unlock offline content, which is exactly the gap the auditors raised.