hardMultiple ChoiceObjective-mapped
CCSP Practice Question: A company uses a cloud-based file storage service…
A company uses a cloud-based file storage service and wants to enable client-side encryption to prevent the cloud provider from accessing plaintext data. Which of the following MUST be implemented?
⚠ Common exam trap
ISC2 often tests the distinction between server-side and client-side encryption, where candidates mistakenly think SSE-C or KMS with customer keys qualifies as client-side encryption, but the key differentiator is whether the cloud provider ever has access to the plaintext key or performs any cryptographic operation on the data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Envelope encryption with a master key stored on-premises
Client-side encryption requires that encryption keys are never accessible to the cloud provider. Envelope encryption with a master key stored on-premises ensures the data encryption key (DEK) is encrypted by a master key that remains under the customer's exclusive control, so the cloud service never has the plaintext key or data. This satisfies the requirement of preventing the provider from accessing plaintext data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
SSE-C still allows the server to see plaintext during processing.
- ✓
Envelope encryption with a master key stored on-premises
Why this is correct
Envelope encryption allows client-side encryption; master key on-premises ensures provider cannot access.
- ✗
Transport Layer Security (TLS) for all uploads
Why it's wrong here
TLS protects data in transit, not at rest from provider.
- ✗
Key management service (KMS) with auto-rotation
Why it's wrong here
KMS alone does not provide client-side encryption.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.