hardMultiple ChoiceObjective-mapped
CV0-004 Practice Question: Must comply with a regulation requiring that all…
An organization must comply with a regulation requiring that all data stored in the cloud be encrypted at rest using a cloud provider's native encryption service. The company also needs to maintain control over the encryption keys. Which solution should the architect recommend?
⚠ Common exam trap
CompTIA often tests the distinction between 'native encryption service' and 'encryption at rest'—candidates mistakenly think any encryption (like client-side or third-party HSM) satisfies the requirement, but the question explicitly demands the cloud provider's native service with customer-managed keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the cloud provider's native encryption service with customer-managed keys
The regulation requires cloud-native encryption at rest with customer-controlled keys. Cloud providers offer services like AWS KMS with customer-managed keys (CMKs) or Azure Key Vault with customer-managed keys, which allow the organization to create, rotate, and disable keys independently while the provider handles the underlying encryption of data at rest using envelope encryption. This satisfies both the 'native encryption service' and 'maintain control over the encryption keys' requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the cloud provider's native encryption service with customer-managed keys
Why this is correct
This meets compliance and provides key control through the provider's key management service.
- ✗
Encrypt the data on-premises before uploading to the cloud
Why it's wrong here
This requires additional steps and may not leverage native cloud encryption.
- ✗
Use the cloud provider's default encryption with provider-managed keys
Why it's wrong here
Provider-managed keys do not give the organization control over the keys.
- ✗
Use a third-party hardware security module (HSM) hosted on-premises
Why it's wrong here
This is not a native cloud solution and may not integrate seamlessly.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 977 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.