Protection is bound to the file so the data stays secure regardless of where it moves is correct. Persistent protection describes file level controls that travel with the data so encryption, labels, and usage restrictions remain effective even after the file leaves the original repository.

This is implemented by embedding protection metadata or by applying rights management and cryptographic controls to the file. The protected file enforces access and usage policies at open time and can require authentication or online policy checks so the data remains protected on other devices and in other cloud services.

Cloud Data Loss Prevention is incorrect because DLP solutions focus on discovery, classification, and preventing exfiltration rather than binding protection to the file itself.

Access rights can be revised after a document is shared is incorrect as the best description of persistent protection. Changing rights after sharing describes dynamic administrative control and not the core idea that protection persistently travels with the file.

Time limited access or expiration controls can be attached to files is incorrect because expiration is a temporary restriction and not the defining characteristic of persistent protection. Expiration may be a feature of some protection schemes but persistent protection emphasizes security that remains with the file regardless of its location.

Full AWS Practitioner Certification Question