mediumMultiple SelectObjective-mapped
CCSP Data at rest encryption Practice Question
A company is designing a data at rest encryption strategy for their cloud environment. Which TWO of the following are valid approaches? (Choose two.)
⚠ Common exam trap
A common trap is to consider client-side encryption as a data-at-rest strategy. However, for data at rest within the cloud provider's environment, server-side encryption (either with customer-provided or cloud-managed keys) is the direct approach. Client-side encryption protects data before it is stored and is not a server-side at-rest mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-side encryption with customer-provided keys
Server-side encryption with customer-provided keys and server-side encryption with cloud-managed keys are both valid approaches for protecting data at rest in the cloud. In the first, the customer controls the encryption keys while the provider handles encryption/decryption. In the second, the provider manages the keys entirely. Both ensure data is encrypted while stored. Client-side encryption, while useful, is not a data-at-rest encryption strategy per se because it is performed before data reaches the provider's storage; it is more accurately described as an encryption-in-transit or client-side protection method. The question asks for data-at-rest encryption approaches, which are server-side by definition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Server-side encryption with customer-provided keys
Why this is correct
Correct. Server-side encryption with customer-provided keys is a valid data-at-rest encryption approach where the customer supplies the encryption key and the provider performs encryption/decryption.
- ✗
Hashing data before storage
Why it's wrong here
Incorrect. Hashing is a one-way function that does not preserve the ability to decrypt data, so it is not encryption.
- ✗
Client-side encryption
Why it's wrong here
Incorrect. While client-side encryption protects data before it is sent, it is not a server-side data-at-rest encryption strategy. The question specifically asks for approaches to encrypt data at rest within the cloud environment, which are server-side methods.
- ✗
Tokenization of sensitive fields
Why it's wrong here
Incorrect. Tokenization replaces sensitive data with non-sensitive tokens but does not use encryption and is not reversible without the token mapping.
- ✓
Server-side encryption with cloud-managed keys
Why this is correct
Correct. Server-side encryption with cloud-managed keys, such as SSE-S3, is a valid data-at-rest encryption approach where the cloud provider manages the encryption keys.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.