mediumMultiple ChoiceObjective-mapped
CCSP Practice Question: A company uses a cloud provider's object storage…
A company uses a cloud provider's object storage service for backup data. The security policy requires that data be encrypted at rest using keys managed by the company's on-premises hardware security module (HSM). Which encryption method should be used?
⚠ Common exam trap
ISC2 often tests the distinction between 'customer-provided keys' (SSE-C) and 'customer-managed keys' (SSE-KMS) versus true client-side encryption, where candidates mistakenly assume that providing or managing keys in the cloud satisfies on-premises HSM control, but the trap is that SSE-C and SSE-KMS still involve the cloud provider's servers performing encryption/decryption, which exposes the key or plaintext to the provider's environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Client-side encryption
Client-side encryption is the only method where the encryption keys are generated and managed entirely within the customer's on-premises HSM, and data is encrypted before it is sent to the cloud provider's object storage. This ensures that the cloud provider never has access to the plaintext data or the encryption keys, fully satisfying the policy requirement that keys be managed by the company's on-premises HSM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Client-side encryption
Why this is correct
Correct: Encrypts data on-premises, keys remain on-premises HSM.
- ✗
Server-side encryption with customer-provided keys (SSE-C)
Why it's wrong here
Keys are sent with each request but not stored on-premises permanently.
- ✗
Server-side encryption with cloud provider-managed keys (SSE-S3)
Why it's wrong here
Keys are managed by the cloud provider.
- ✗
Server-side encryption with customer-managed keys (SSE-KMS)
Why it's wrong here
KMS keys are managed in the cloud, not on-premises HSM.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.