hardMultiple ChoiceObjective-mapped
Ensuring Data Confidentiality in Cloud Breach: Client-Side Encryption
An organization uses a third-party cloud service for data storage. Which of the following is the BEST way to ensure data confidentiality in the event of a cloud provider breach?
Quick Answer
The answer is client-side encryption before uploading data. This approach ensures data confidentiality in a cloud breach because encryption occurs on the organization’s own systems, meaning the cloud provider never possesses the plaintext or the decryption keys. Even if an attacker compromises the provider’s infrastructure, the encrypted data remains unreadable without the keys held solely by the organization. On the CISA exam, this question tests your understanding of data ownership and cryptographic controls in shared responsibility models—a common trap is assuming server-side encryption or SSL/TLS in transit offers the same protection, but those still expose data to the provider. Remember the mnemonic: “Encrypt before you send, keys you defend.” This principle is critical because client-side encryption is the only method that guarantees confidentiality regardless of the provider’s security posture, making it the definitive answer for auditor-focused scenarios.
⚠ Common exam trap
ISACA often tests the distinction between encryption at rest (provider-managed) and client-side encryption, where candidates mistakenly assume that any encryption at rest is sufficient to protect against a provider breach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement client-side encryption before uploading data
Client-side encryption ensures that data is encrypted before it leaves the organization's control, so the cloud provider never has access to the plaintext or the encryption keys. In the event of a provider breach, the encrypted data remains confidential because only the organization holds the keys to decrypt it. This is the only option that guarantees confidentiality regardless of the cloud provider's security posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rely on the cloud provider's encryption at rest
Why it's wrong here
Provider may have access to keys.
- ✗
Use TLS for data in transit
Why it's wrong here
TLS does not protect data at rest.
- ✓
Implement client-side encryption before uploading data
Why this is correct
Client-side encryption ensures only the organization controls keys.
- ✗
Deploy a cloud access security broker (CASB) with DLP
Why it's wrong here
CASB helps monitor but does not guarantee confidentiality in breach.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 995 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization is migrating sensitive customer data to a public cloud. Which of the following encryption strategies provides the STRONGEST protection against data exposure to the cloud provider?
medium- A.Use transport layer security (TLS) for data in transit
- ✓ B.Implement client-side encryption with keys managed on-premises
- C.Encrypt data at rest using server-side encryption with AES-256
- D.Enable the cloud provider's key management service
Why B: Client-side encryption with keys managed on-premises ensures that the cloud provider never has access to the encryption keys or the plaintext data. Even if the cloud provider's infrastructure is compromised or they have administrative access, the data remains encrypted and unreadable. This provides the strongest protection because the cloud provider is excluded from the cryptographic trust boundary.
Variation 2. An organization stores sensitive research data in a cloud storage service. The data must be encrypted at rest and in transit, and the organization wants to maintain control over encryption keys. Which solution best meets these requirements?
hard- A.Use a cloud hardware security module (HSM) to generate keys
- ✓ B.Implement client-side encryption using a customer-managed key vault
- C.Enable HTTPS for all data transfers
- D.Use server-side encryption with AWS S3 managed keys (SSE-S3)
Why B: Client-side encryption with a customer-managed key vault ensures data is encrypted before it leaves the client environment, so the cloud provider never has access to plaintext or the encryption keys. This satisfies both at-rest and in-transit encryption requirements while giving the organization full control over key management, unlike server-side options where the provider manages at least part of the key lifecycle.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.