hardMultiple ChoiceObjective-mapped
CV0-004 Practice Question: A multinational corporation runs a critical…
A multinational corporation runs a critical application on a private cloud hosted in their data center. The application uses virtual machines (VMs) that are attached to a storage area network (SAN) for block storage. The company is migrating the application to a public cloud IaaS model to reduce on-premises costs. The security team mandates that all data at rest in the cloud must be encrypted using customer-managed keys, and the cloud provider must not have access to the keys. The application requires low-latency block storage for a database. The storage must be replicated within the same region for availability. The cloud architect needs to choose a storage solution that meets these security and performance requirements. The cloud provider offers: (A) Object storage with server-side encryption using provider-managed keys. (B) Ephemeral instance storage with encryption at rest using provider-managed keys. (C) Persistent block storage volumes with encryption using customer-managed keys stored in the provider's key management service (KMS) integrated with hardware security modules (HSM). (D) Network file system (NFS) shares encrypted with customer-managed keys managed on-premises. Which option should the architect choose?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Persistent block storage volumes with encryption using customer-managed keys stored in the provider's KMS/HSM
It provides persistent block storage volumes, which are required for low-latency database workloads. The encryption uses customer-managed keys stored in the provider's key management service (KMS) integrated with hardware security modules (HSM), ensuring the provider cannot access the keys. This meets the security mandate. Option A is wrong because object storage is not suitable for low-latency block storage, and it uses provider-managed keys. Option B is wrong because ephemeral instance storage is not persistent and replication is not guaranteed; also it uses provider-managed keys. Option D is wrong because NFS is file storage, not block, and managing keys on-premises introduces latency and complexity, which contradicts the low-latency requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Object storage with server-side encryption using provider-managed keys.
Why it's wrong here
Object storage with server-side encryption using provider-managed keys. This is wrong because object storage is not suitable for low-latency block storage, and it uses provider-managed keys, violating the customer-managed key requirement.
- ✗
Ephemeral instance storage with encryption at rest using provider-managed keys.
Why it's wrong here
Ephemeral instance storage with encryption at rest using provider-managed keys. This is wrong because ephemeral storage is not persistent and replication is not guaranteed; also it uses provider-managed keys.
- ✓
Persistent block storage volumes with encryption using customer-managed keys stored in the provider's KMS/HSM
Why this is correct
Persistent block storage volumes with encryption using customer-managed keys stored in the provider's KMS/HSM. This is correct because it provides low-latency block storage, meets the customer-managed key mandate, and ensures the provider cannot access the keys.
- ✗
Network file system (NFS) shares encrypted with customer-managed keys managed on-premises.
Why it's wrong here
Network file system (NFS) shares encrypted with customer-managed keys managed on-premises. This is wrong because NFS is file storage, not block, and managing keys on-premises introduces latency and complexity, contrary to the low-latency requirement.
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.