hardMultiple Choice
Customer-Managed Encryption Keys: Dedicated HSM with Automated Key Rotation
An organization must comply with a regulation requiring that all data stored in the cloud be encrypted at rest using a cloud provider's native encryption service. The company also needs to maintain control over the encryption keys. Which solution should the architect recommend?
⚠ Common exam trap
CompTIA often tests the distinction between 'native encryption service' and 'encryption at rest'—candidates mistakenly think any encryption (like client-side or third-party HSM) satisfies the requirement, but the question explicitly demands the cloud provider's native service with customer-managed keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the cloud provider's native encryption service with customer-managed keys
The regulation requires cloud-native encryption at rest with customer-controlled keys. Cloud providers offer services like AWS KMS with customer-managed keys (CMKs) or Azure Key Vault with customer-managed keys, which allow the organization to create, rotate, and disable keys independently while the provider handles the underlying encryption of data at rest using envelope encryption. This satisfies both the 'native encryption service' and 'maintain control over the encryption keys' requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the cloud provider's native encryption service with customer-managed keys
Why this is correct
The provider's native encryption service satisfies the mandate for cloud-native encryption at rest, while customer-managed keys retain organisational control over key material. This combination meets both the regulatory encryption requirement and the key-ownership constraint without relying on provider-held keys.
- ✗
Encrypt the data on-premises before uploading to the cloud
Why it's wrong here
Client-side encryption before upload bypasses the provider's native encryption service and leaves key custody outside it, failing the stated requirement. It is tempting because pre-upload encryption genuinely protects data in transit and at rest, which would be correct where provider-managed keys are prohibited.
- ✗
Use the cloud provider's default encryption with provider-managed keys
Why it's wrong here
Provider-managed keys leave the cloud provider holding and controlling the key material, so the company loses the custody the regulation demands. It is tempting because default encryption is native, free and instant, and would satisfy the requirement where the regulation mandates encryption at rest but imposes no key-ownership condition.
- ✗
Use a third-party hardware security module (HSM) hosted on-premises
Why it's wrong here
A third-party on-premises HSM provides customer-controlled keys but not the cloud provider's native encryption service, so it breaches the regulation's explicit requirement. It is tempting because external HSMs genuinely deliver key custody and FIPS 140-2 separation, and would be right where the mandate demands keys never reside with the provider.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 834 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.