CCSP Cloud Data Security Practice Question
A cloud security architect is designing a key management strategy for a hybrid cloud environment. The organization requires that encryption keys never leave their on-premises hardware security module (HSM) due to strict regulatory mandates, yet cloud services must be able to perform encryption operations on data at rest. Which key management approach meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hold Your Own Key (HYOK)
HYOK (Hold Your Own Key) keeps the key in the customer's on-prem HSM; the cloud service sends data to be encrypted/decrypted on-prem, which can introduce latency but satisfies key location constraints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Customer-managed encryption keys (CMEK)
Why it's wrong here
CMEK keys are stored in cloud KMS, not on-prem.
- ✓
Hold Your Own Key (HYOK)
Why this is correct
Correct: HYOK keeps the key in the customer's HSM; cloud service calls back to on-prem for crypto operations.
- ✗
Cloud provider default encryption
Why it's wrong here
Default encryption uses provider-managed keys, not customer-controlled.
- ✗
Bring Your Own Key (BYOK)
Why it's wrong here
BYOK imports key material to cloud KMS, so key resides in cloud.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.