Domain 2 · Objective reference 2.6 · Chapter 18 of 62
Tailor data protection to state and requirements
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Match the safeguard to the state and the threat.
Explore the anchors
Protect stored data and storage access.
Concept matching activity
Match this task or description to its concept:
Protect communication and peer trust.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
- DRM, DLP and CASB solve different problems
Concepts and mechanisms
Data at rest, in transit and in use have different exposure paths. Storage encryption, authenticated transport, restricted execution, access decisions and monitoring protect different parts of the lifecycle. Data-loss prevention can identify or restrict selected flows; rights-management systems can impose usage conditions; cloud-access controls can govern selected service interactions. None replaces accurate ownership and purpose.
Design, evidence and tradeoffs
Scope and tailor controls to information sensitivity, processing and obligations. Check what happens after authorized decryption, export or display. A system with read and decrypt rights can obtain plaintext despite encryption at rest. Validate intended access and rejected access, and examine key custody and recovery. For derived data or model assets, consider whether outputs expose information beyond the approved audience.
DRM, DLP and CASB solve different problems
Digital rights management applies usage restrictions within supported ecosystems. Data loss prevention detects or controls selected data movement using defined rules and inspection scope. A cloud access security broker mediates or observes supported cloud-service use and policy enforcement. None replaces ownership, correct classification or lawful processing. Select controls for data at rest, in transit and in use, then scope and tailor them to the system. Test the enforcement path and exceptions; encrypted traffic and unmanaged applications can limit visibility.
Worked example
A tenant restricts document sharing and decrypt permissions rather than assuming the provider’s encrypted storage prevents public links.
Check your understanding
Why does one encryption setting not establish protection of every data state?
Show explanation
The data can be exposed before encryption, after decryption, at an endpoint or through authorized but excessive permissions.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.