mediumMultiple Choice
CISA Practice Question: Is migrating sensitive customer data to a public…
An organization is migrating sensitive customer data to a public cloud. Which of the following encryption strategies provides the STRONGEST protection against data exposure to the cloud provider?
⚠ Common exam trap
It's easy for candidates to confuse 'encryption at rest' or 'TLS' with full data protection, failing to realize that these methods still allow the cloud provider to access plaintext data either during processing or through key management access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement client-side encryption with keys managed on-premises
Client-side encryption with keys managed on-premises ensures that the cloud provider never has access to the encryption keys or the plaintext data. Even if the cloud provider's infrastructure is compromised or they have administrative access, the data remains encrypted and unreadable. This provides the strongest protection because the cloud provider is excluded from the cryptographic trust boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use transport layer security (TLS) for data in transit
Why it's wrong here
TLS protects data only while moving across the network; once stored, the cloud provider holds plaintext it can access, so exposure risk remains. TLS is tempting because it is mandatory for transit, but the strongest protection against provider exposure requires customer-managed keys encrypting data at rest.
- ✓
Implement client-side encryption with keys managed on-premises
Why this is correct
Client-side encryption with on-premises key management ensures plaintext and keys never reach the provider, so the cloud only stores ciphertext. This directly satisfies the stem's constraint of strongest protection against exposure to the cloud provider itself, unlike provider-managed keys where Microsoft Entra ID or the vendor could technically access data.
- ✗
Encrypt data at rest using server-side encryption with AES-256
Why it's wrong here
Server-side encryption with provider-managed keys leaves the cloud provider able to decrypt stored data, so it does not deliver the strongest protection against provider exposure. It is tempting because AES-256 satisfies compliance baselines, but customer-managed keys held outside the provider's control are required to prevent that access.
- ✗
Enable the cloud provider's key management service
Why it's wrong here
Provider-managed keys leave the provider able to decrypt data, so it can be compelled or breached to expose plaintext. It is tempting because it simplifies key lifecycle and rotation, and would suit non-sensitive workloads where operational overhead outweighs provider trust concerns.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.