easyMultiple ChoiceObjective-mapped
CCSP Practice Question: Migrating its customer database to a cloud object…
A company is migrating its customer database to a cloud object storage service. The database contains personally identifiable information (PII). The security team requires that all data be encrypted at rest and that the company retains exclusive control over the encryption keys. Which solution BEST meets these requirements?
⚠ Common exam trap
It's easy for candidates to confuse SSE-C with client-side encryption, assuming that providing your own key to the server (SSE-C) gives you exclusive control, but in SSE-C the cloud provider still handles the encryption/decryption process and may retain the key in memory, whereas client-side encryption ensures the provider never sees the key at all.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use client-side encryption with customer-managed keys stored on-premises.
Client-side encryption with customer-managed keys stored on-premises ensures that the encryption keys never leave the company's control, and the data is encrypted before it is uploaded to the cloud object storage service. This satisfies both the requirement for encryption at rest and exclusive key control, as the cloud provider never has access to the plaintext keys or the ability to decrypt the data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use server-side encryption with cloud provider-managed keys (SSE-S3).
Why it's wrong here
Keys are managed by the CSP, not exclusive to the company.
- ✗
Use SSL/TLS encryption for data in transit only.
Why it's wrong here
Only addresses data in transit, not at rest.
- ✓
Use client-side encryption with customer-managed keys stored on-premises.
Why this is correct
Keys never leave the company; exclusive control maintained.
- ✗
Use server-side encryption with customer-provided keys (SSE-C).
Why it's wrong here
Key must be transmitted with each request, still exposed to network.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.