easyMultiple ChoiceObjective-mapped
CCSP Practice Question: A cloud customer wants to ensure that their data…
A cloud customer wants to ensure that their data is encrypted during transmission between their on-premises data center and the cloud provider's service. Which protocol should they use?
⚠ Common exam trap
ISC2 often tests the distinction between network-layer encryption (IPSec) and transport-layer encryption (TLS), leading candidates to choose IPSec because it is commonly associated with 'secure transmission' between sites, but the question specifies 'between their on-premises data center and the cloud provider's service,' which implies application-level communication, not a full network tunnel.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Transport Layer Security (TLS) 1.2
TLS 1.2 is the correct choice because it is specifically designed to secure data in transit over networks, such as between an on-premises data center and a cloud provider. It operates at the transport layer, providing encryption, authentication, and integrity for HTTP-based traffic (HTTPS), which is the most common method for cloud API interactions. IPSec, while also a valid encryption protocol, is typically used for site-to-site VPN tunnels at the network layer, not for securing individual service-to-service transmissions like those to a cloud provider's REST API.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Internet Protocol Security (IPSec)
Why it's wrong here
IPSec operates at the network layer (Layer 3) and secures IP packets, but the scenario requires encryption specifically for data in transit to a cloud service, which typically uses application-layer protocols such as HTTPS (TLS). IPSec is tempting because it provides robust encryption for site-to-site VPN tunnels between on-premises networks and cloud VPCs, making it the correct choice for securing all IP traffic between two gateways, not for protecting individual API or service calls to a cloud provider's endpoint.
- ✓
Transport Layer Security (TLS) 1.2
Why this is correct
TLS is the standard for encrypting data in transit over networks.
- ✗
Secure Shell (SSH)
Why it's wrong here
SSH is for secure remote login, not typically for bulk data transfer.
- ✗
Remote Desktop Protocol (RDP)
Why it's wrong here
RDP is for remote desktop, not general data transfer.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.