Document Security, Compliance, and Administration
Security questions test whether you can protect a PDF appropriately without breaking legitimate use. Know the two layers: document-level protection (open password to restrict who can open, permissions password to restrict printing, copying, or editing) and account or organizational controls (admin console settings, user management, retention). Understand that permissions are enforced by compliant viewers and are a deterrent, not absolute encryption against every tool.
Compliance concepts: redaction permanently removes content - it is not the same as drawing a black box or highlighting, which leaves text underneath recoverable. Redaction must be applied and the file saved to remove the underlying data. Also know metadata scrubbing (removing hidden author, comments, and attachments before external sharing) and the importance of accessibility tagging for compliance with accessibility standards.
Administration topics: the admin console manages users, licenses, groups, and security policies; single sign-on and directory sync centralize identity; audit logs and retention policies support governance. Traps: questions that treat a black rectangle as redaction; assuming a password protects a file once it is decrypted and re-saved; and confusing a permissions restriction with encryption.
Rule of thumb: before sending externally, sanitize - redact truly sensitive content, remove metadata and hidden layers, then apply protection if needed. Worked example: a legal team must share a contract with a third party but hide a fee schedule. Correct approach: apply redaction to the fee text, save, verify the text is gone, then optionally add a permissions password. Drawing a black shape over the text fails because the underlying content remains extractable.