CCSP Cloud Data Security Practice Question
A company is deploying a cloud application that processes customers' personal data. They need to ensure data in transit is protected. Which THREE of the following are appropriate controls for data in transit? (Select THREE.)
⚠ Common exam trap
The trap is mixing data-at-rest controls (AES-256) and governance controls (classification labels) with in-transit encryption; the exam tests whether you can distinguish the three data states.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establishing a VPN for hybrid connectivity
Option A is correct because a VPN (e.g., IPsec or TLS-based tunnel) encrypts traffic between on-premises networks and the cloud, protecting data in transit across hybrid connections. Option C is correct because enforcing HTTPS ensures web application traffic is encrypted with TLS, preventing eavesdropping or tampering over the network. Option E is correct because using TLS 1.2 for API communications encrypts data in transit between clients and services, providing confidentiality and integrity. Option B is not correct because data classification labels identify sensitivity and guide handling but do not themselves encrypt or protect data in transit. Option D is not correct because AES-256 encryption at rest protects stored data, not data moving across a network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Establishing a VPN for hybrid connectivity
Why this is correct
A VPN encrypts traffic traversing untrusted networks between on-premises infrastructure and the cloud provider, using protocols such as IPsec. This protects data in transit for hybrid connectivity, satisfying the stem's requirement to safeguard personal data moving between environments.
- ✗
Setting data classification labels on the data
Why it's wrong here
Data classification labels identify sensitivity and drive handling policy; they do not protect data moving across networks. It is tempting because classification underpins encryption and access decisions, but it is a governance control, whereas TLS and similar mechanisms secure data in transit.
- ✓
Enforcing HTTPS for web application access
Why this is correct
Enforcing HTTPS wraps web application traffic in TLS, encrypting data between browser and server and preventing interception or tampering en route. This directly satisfies the stem's requirement to protect customers' personal data in transit for web application access.
- ✗
Encrypting data at rest using AES-256
Why it's wrong here
AES-256 encryption at rest protects stored data, not data moving between systems. It is tempting because encryption is a core data-protection control, but the relevant axis is state: at-rest encryption leaves transit exposed, so TLS or IPsec is required for data in transit.
- ✓
Using TLS 1.2 for all API communications
Why this is correct
TLS 1.2 encrypts API traffic between clients and services, providing confidentiality and integrity during transmission. Using it for all API communications satisfies the stem's requirement to protect personal data in transit, and it supersedes deprecated SSL and early TLS versions.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.