hardMultiple ChoiceObjective-mapped
CISA Practice Question: Stores sensitive research data in a cloud storage…
An organization stores sensitive research data in a cloud storage service. The data must be encrypted at rest and in transit, and the organization wants to maintain control over encryption keys. Which solution best meets these requirements?
⚠ Common exam trap
Watch out — candidates often confuse server-side encryption with customer-managed keys (e.g., SSE-KMS or SSE-C) as giving full control, but those still allow the cloud provider to process the data server-side, whereas client-side encryption ensures the provider never has access to plaintext.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement client-side encryption using a customer-managed key vault
Client-side encryption with a customer-managed key vault ensures data is encrypted before it leaves the client environment, so the cloud provider never has access to plaintext or the encryption keys. This satisfies both at-rest and in-transit encryption requirements while giving the organization full control over key management, unlike server-side options where the provider manages at least part of the key lifecycle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a cloud hardware security module (HSM) to generate keys
Why it's wrong here
HSM provides key storage but may not give full control if provider manages policies.
- ✓
Implement client-side encryption using a customer-managed key vault
Why this is correct
Client-side encryption ensures data is encrypted before reaching the cloud, and keys are controlled by the organization.
- ✗
Enable HTTPS for all data transfers
Why it's wrong here
HTTPS protects in transit but not at rest.
- ✗
Use server-side encryption with AWS S3 managed keys (SSE-S3)
Why it's wrong here
AWS manages keys, not the organization.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.