mediumMultiple ChoiceObjective-mapped
CISA Practice Question: Is migrating sensitive customer data to a public…
An organization is migrating sensitive customer data to a public cloud. Which of the following encryption strategies provides the STRONGEST protection against data exposure to the cloud provider?
⚠ Common exam trap
It's easy for candidates to confuse 'encryption at rest' or 'TLS' with full data protection, failing to realize that these methods still allow the cloud provider to access plaintext data either during processing or through key management access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement client-side encryption with keys managed on-premises
Client-side encryption with keys managed on-premises ensures that the cloud provider never has access to the encryption keys or the plaintext data. Even if the cloud provider's infrastructure is compromised or they have administrative access, the data remains encrypted and unreadable. This provides the strongest protection because the cloud provider is excluded from the cryptographic trust boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use transport layer security (TLS) for data in transit
Why it's wrong here
TLS only protects data during transmission, not at rest in the cloud.
- ✓
Implement client-side encryption with keys managed on-premises
Why this is correct
Client-side encryption ensures data is encrypted before leaving the premises, and the cloud provider never has access to plaintext or keys.
- ✗
Encrypt data at rest using server-side encryption with AES-256
Why it's wrong here
Server-side encryption means the cloud provider manages encryption keys and may have access to plaintext.
- ✗
Enable the cloud provider's key management service
Why it's wrong here
Cloud KMS gives the provider access to encryption keys, reducing protection against provider exposure.
Go deeper
Related to this question
About these practice questions
One of 995 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.