mediumMultiple Choice
CAS-004 Practice Question: Migrating its on-premises ERP system to a public…
A company is migrating its on-premises ERP system to a public cloud IaaS environment. The ERP system contains sensitive financial data. Which of the following architectural changes best maintains data security during and after migration?
⚠ Common exam trap
Test-takers frequently assume encryption after migration is sufficient, overlooking the critical need to protect data during the migration phase, or they may underestimate the importance of IAM as a complementary security control to encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypt the data at rest and in transit, and implement IAM policies
Encrypting data at rest (using AES-256 or similar) and in transit (using TLS 1.2/1.3 or IPsec) ensures confidentiality during migration and after the ERP is hosted in the cloud. Implementing IAM policies with least-privilege access controls prevents unauthorized access to the sensitive financial data, addressing both data protection and access management requirements for a public cloud IaaS environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Leverage the cloud provider's default security groups and disable encryption
Why it's wrong here
Default security groups are permissive and disabling encryption removes protection for financial data at rest and in transit. It is tempting because provider default controls reduce configuration effort, but they suit non-sensitive workloads; here the data classification mandates explicit encryption and hardened network rules.
- ✓
Encrypt the data at rest and in transit, and implement IAM policies
Why this is correct
IaaS leaves the guest OS, application and data under customer control, so the shared responsibility model places encryption of data at rest and in transit plus identity and access management policies firmly with the company. This preserves confidentiality of financial data throughout and after migration.
- ✗
Migrate the ERP without changes and apply encryption after migration
Why it's wrong here
Migrating unencrypted and encrypting afterwards leaves financial data exposed in transit and at rest during the migration window. It is tempting because post-migration encryption is a valid hardening step, but the stem demands security be maintained during migration, which requires encryption applied before or throughout the transfer.
- ✗
Use a VPN to connect on-premises and cloud while keeping data unencrypted
Why it's wrong here
A VPN secures the network path only; unencrypted data remains readable at rest in cloud storage and to anyone with storage-level access. It is tempting because VPNs are a standard hybrid connectivity control, but they address transit confidentiality, not the at-rest encryption the financial data requires.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.