easyMultiple ChoiceObjective-mapped
CCSP Practice Question: A cloud consumer uses an IaaS provider for…
A cloud consumer uses an IaaS provider for storage of archived financial records. Regulatory requirements mandate that data at rest be encrypted using a key that is under the consumer's sole control. Which encryption approach should the consumer implement?
⚠ Common exam trap
ISC2 often tests the distinction between 'customer-provided keys' (SSE-C) and 'client-side encryption' — candidates confuse SSE-C as giving sole control, but the key is still used by the provider's infrastructure, not solely under the consumer's control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use client-side encryption with keys stored in the consumer's on-premises HSM
Client-side encryption ensures the data is encrypted before it leaves the consumer's environment, and storing the keys in the consumer's on-premises HSM guarantees sole control over the encryption keys, meeting the regulatory requirement for data-at-rest encryption with keys under the consumer's sole control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use client-side encryption with keys stored in the consumer's on-premises HSM
Why this is correct
Client-side encryption gives the consumer sole control over encryption keys.
- ✗
Use a TLS tunnel to the storage service
Why it's wrong here
TLS protects data in transit, not at rest.
- ✗
Enable server-side encryption with keys managed by the cloud provider
Why it's wrong here
Provider-managed keys do not meet the consumer control requirement.
- ✗
Use server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
SSE-C keys are still stored on the server, so the provider has access.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.