ISC2 CC Security Principles Practice Question
A hospital's IT department is choosing a security control to protect patient records. The control must render data unreadable to anyone who does not hold the cryptographic key, even if the storage media is stolen. Which type of control BEST meets this requirement?
⚠ Common exam trap
The trap here is assuming that strong access control or monitoring protects data on stolen media, when only cryptographic transformation of the data itself does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encryption of the data at rest
The requirement is that stored records stay unreadable without the cryptographic key, which is precisely what encryption at rest delivers. Access control, monitoring, and backups all have security value, but none of them transform the data itself, so a thief holding the physical media could still read every record. Only encryption makes the stolen media useless to an attacker lacking the key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Encryption of the data at rest
Why this is correct
Encryption at rest transforms stored data into ciphertext using a cryptographic key, so stolen media reveals nothing usable without that key. This directly satisfies the hospital's requirement and supports the confidentiality objective of the CIA triad. It is a preventive, technical control applied to the data itself rather than to physical access or user behaviour.
- ✗
Role-based access control on the records
Why it's wrong here
Role-based access control restricts which authenticated users may read records through the application, but it does not alter how data sits on disk. An attacker who steals the physical media bypasses the application layer entirely and reads the files directly. Access control therefore cannot satisfy the requirement that stolen media remain unreadable without a key.
- ✗
Full database activity monitoring
Why it's wrong here
Database activity monitoring records and alerts on queries and access patterns, which helps detect misuse but leaves the underlying records in readable form. If the storage media is physically stolen, the monitoring logs provide no protection because the data itself is not transformed. Monitoring is detective rather than the preventive confidentiality control the scenario demands.
- ✗
Daily offsite backup of the database
Why it's wrong here
Backups improve availability and support recovery after loss or ransomware, but a backup copy is simply another readable copy of the same records. If that media is stolen, the data is exposed unless encryption is also applied. Backup alone addresses availability and integrity recovery, not the confidentiality requirement described in the scenario.
Go deeper
Related to this question
Learn chapter
Physical Access Controls
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Encryption at rest
Encryption at rest is the practice of securing stored data by converting it into an unreadable format using cryptographic algorithms, so that even if physical or digital access to the storage medium is obtained, the data remains confidential.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.