SY0-701 Security Architecture Practice Question
A team hosts a confidential document repository on an IaaS virtual machine. The provider secures the datacenter, hardware, and hypervisor. The organization wants to control who can decrypt the files and be able to revoke that access without changing providers. Which control is best?
⚠ Common exam trap
Test-takers frequently confuse network access controls (security groups/ACLs) with encryption-based access control, failing to recognize that only cryptographic controls can enforce decryption revocation independently of the provider.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use customer-managed encryption keys in the cloud KMS or HSM.
Customer-managed encryption keys (CMEK) in a cloud KMS or HSM allow the organization to retain control over key material, enabling them to decrypt files and revoke access independently of the cloud provider. This meets the requirement to control decryption and revocation without changing providers, as the provider cannot access the keys. In contrast, provider-managed keys do not offer the same level of tenant-controlled revocation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the provider's default managed encryption keys for the storage service.
Why it's wrong here
Provider-managed default encryption keys place the key lifecycle entirely under the provider's control. This limits the customer's ability to independently rotate, disable, or cryptographically shred keys in response to a security incident or compliance obligation. While the data is encrypted at rest, the provider retains the ability to decrypt it on behalf of its own operations, which weakens the separation of duties and may fail regulatory requirements for customer control over access to confidential documents.
- ✗
Rely on security groups and network ACLs to protect the document contents.
Why it's wrong here
Security groups and network ACLs are perimeter controls that filter traffic based on IP addresses, ports, and protocols. They do not inspect the content of encrypted storage or enforce authentication and authorization at the data level. A user with valid credentials or an exploited application session can still access the documents through legitimate channels, and if the files are encrypted, network controls do not manage or protect the decryption keys. Therefore, they cannot ensure that only authorized parties can read the actual document contents.
- ✓
Use customer-managed encryption keys in the cloud KMS or HSM.
Why this is correct
Customer-managed encryption keys in a cloud KMS or HSM give the organization direct control over key rotation, revocation, and usage policies. When a key is revoked, the ciphertext remains but is effectively undecryptable, enabling crypto-shredding and independent revocation even if the provider's infrastructure is compromised. The provider performs cryptographic operations but does not own or solely govern the key material, strengthening separation of duties and meeting compliance requirements for confidential repositories. This is the correct control for enforcing that only the organization can grant or deny access to the document contents.
- ✗
Enable automated snapshots so deleted files can be restored later.
Why it's wrong here
Automated snapshots are a data backup and recovery mechanism that captures point-in-time copies of storage volumes. They do not alter encryption state or access control policies; if the original data is encrypted, the snapshot is encrypted with the same keys, but the snapshot itself does not protect those keys or decide who can decrypt them. In a data breach scenario, snapshots could actually expand the attack surface because an attacker who gains access to them may obtain historical copies of sensitive documents. Thus, snapshots address availability and resilience, not confidentiality or decryption authorization.
Go deeper
Related to this question
Learn chapter
Cloud Security Fundamentals
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
HSM
An HSM (Hardware Security Module) is a dedicated hardware device that securely generates, stores, and manages cryptographic keys used to protect sensitive data.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.