mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Migrating its on-premises ERP system to a public…
A company is migrating its on-premises ERP system to a public cloud IaaS environment. The ERP system contains sensitive financial data. Which of the following architectural changes best maintains data security during and after migration?
⚠ Common exam trap
Test-takers frequently assume encryption after migration is sufficient, overlooking the critical need to protect data during the migration phase, or they may underestimate the importance of IAM as a complementary security control to encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypt the data at rest and in transit, and implement IAM policies
Encrypting data at rest (using AES-256 or similar) and in transit (using TLS 1.2/1.3 or IPsec) ensures confidentiality during migration and after the ERP is hosted in the cloud. Implementing IAM policies with least-privilege access controls prevents unauthorized access to the sensitive financial data, addressing both data protection and access management requirements for a public cloud IaaS environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Leverage the cloud provider's default security groups and disable encryption
Why it's wrong here
Default settings may not meet compliance requirements; encryption is essential.
- ✓
Encrypt the data at rest and in transit, and implement IAM policies
Why this is correct
This ensures data confidentiality during migration and in the cloud.
- ✗
Migrate the ERP without changes and apply encryption after migration
Why it's wrong here
Data is vulnerable during migration; encryption should be applied before.
- ✗
Use a VPN to connect on-premises and cloud while keeping data unencrypted
Why it's wrong here
Data at rest and in transit must be encrypted; VPN only secures transit.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.