CCSP Cloud Data Security Practice Question
A company is using client-side encryption to encrypt data before uploading to cloud storage. They want to ensure that the cloud provider cannot access the encryption keys. However, they need to allow a cloud-based analytics service to process the data. Which approach should they take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Continue using client-side encryption and provide the analytics service with the encryption key
Client-side encryption ensures the cloud provider does not have access to the encryption keys because the keys are never stored in or managed by the provider. To allow a cloud-based analytics service to process the data, the customer can securely provide the encryption key directly to the analytics service. This approach maintains key control while enabling processing. Note: This assumes the analytics service is trusted and the key is transmitted securely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use client-side encryption but store the key in the cloud provider's key vault
Why it's wrong here
Storing the key in the cloud provider's key vault gives the provider access to the key, violating the requirement.
- ✗
Use envelope encryption with a cloud KMS key and store the data key alongside the encrypted data
Why it's wrong here
Envelope encryption with a cloud KMS key still uses a key stored in the provider's KMS, which the provider can access.
- ✓
Continue using client-side encryption and provide the analytics service with the encryption key
Why this is correct
This approach uses client-side encryption, so the provider does not have access to the key. Providing the key to the analytics service allows processing while keeping the key away from the provider's infrastructure.
- ✗
Switch to server-side encryption with customer-managed keys and grant the analytics service access to the key management service (KMS)
Why it's wrong here
Server-side encryption with customer-managed keys stores the key in the cloud KMS, which is operated by the provider, so the provider can access the key. This does not meet the requirement.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.