hardMultiple ChoiceObjective-mapped
CAS-004 Practice Question: Is tasked with designing a cryptographic solution…
A security engineer is tasked with designing a cryptographic solution to protect data at rest in a multi-tenant cloud storage system. Each tenant's data must be encrypted with a unique key, and the system must support key rotation with minimal performance impact. Which of the following is the BEST approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement envelope encryption: generate a unique data encryption key (DEK) per tenant, encrypt each DEK with a key encryption key (KEK) stored in an HSM, and store the wrapped DEK alongside the data.
Envelope encryption with a unique data encryption key (DEK) per tenant allows independent key rotation and minimizes performance impact by only requiring re-wrapping of the DEK with a new key encryption key (KEK) stored in an HSM. Option A is wrong because storing both the tenant key and the master key in the same database column exposes the master key if the database is compromised. Option C is wrong because a single master key for all tenants violates isolation; if compromised, all tenant data is at risk. Option D is wrong because manual monthly rotation of all keys is not scalable and does not provide per-tenant isolation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate a unique key per tenant and encrypt each key with a master key, then store both in the same database column.
Why it's wrong here
Storing encrypted keys in the same database as the data reduces security; an attacker who gains database access could try to compromise the keys.
- ✓
Implement envelope encryption: generate a unique data encryption key (DEK) per tenant, encrypt each DEK with a key encryption key (KEK) stored in an HSM, and store the wrapped DEK alongside the data.
Why this is correct
Envelope encryption allows per-tenant isolation, easy key rotation (by rewrapping DEKs with new KEKs), and minimal performance impact since data is not re-encrypted on rotation.
- ✗
Use a single master key for all tenants and store the key in a hardware security module (HSM) with access controls.
Why it's wrong here
A single master key means all tenants share the same encryption; a breach of the master key compromises all data, and rotation affects everyone.
- ✗
Implement a periodic key rotation schedule that rotates all tenant keys every month manually.
Why it's wrong here
Manual rotation is error-prone, not scalable, and does not address per-tenant key management; also performance impact can be high if re-encrypting all data.
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.