mediumMultiple ChoiceObjective-mapped
CCSP Practice Question: A company uses a cloud database that stores…
A company uses a cloud database that stores customer financial information. To ensure compliance with PCI DSS, which control is required?
⚠ Common exam trap
ISC2 often tests the distinction between required controls (e.g., encryption for data at rest) and recommended or supporting controls (e.g., network segmentation, MFA, vulnerability scans), leading candidates to pick a broader security measure that is not the specific PCI DSS mandate for stored data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encryption of cardholder data stored in the database
PCI DSS Requirement 3.4 specifically mandates that stored cardholder data must be rendered unreadable anywhere it is stored, including in cloud databases. Encryption at rest (e.g., AES-256) is the primary control to achieve this, as it directly protects the confidentiality of Primary Account Numbers (PANs) if the storage layer is compromised. Without encryption, the data remains in clear text, violating PCI DSS compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Encryption of cardholder data stored in the database
Why this is correct
PCI DSS requires encryption of stored cardholder data.
- ✗
Network segmentation between the database and other systems
Why it's wrong here
Segmentation is a PCI requirement but not the specific control for the database itself.
- ✗
Annual external vulnerability scans of the database
Why it's wrong here
Vulnerability scans are required quarterly, not annually, and are not a primary data protection control.
- ✗
Multi-factor authentication for database administrators
Why it's wrong here
MFA is required for remote access but not a direct data-at-rest protection.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.