CCSP Cloud Data Security Practice Question
A financial institution must ensure that sensitive data processed in the cloud cannot be decrypted by the cloud provider under any circumstances. They also need low latency for data operations. Which encryption model best meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Client-side encryption
Client-side encryption ensures that only the customer holds the decryption keys; the cloud provider never has access to plaintext or keys. This provides maximum control and meets the requirement, though it may introduce some latency if not optimized. The other options involve the provider managing or using keys in a way that potentially allows access to plaintext.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HYOK
Why it's wrong here
HYOK allows the customer to hold their own key, but the cloud provider may still have access to the encryption process, potentially exposing data.
- ✓
Client-side encryption
Why this is correct
Client-side encryption ensures data is encrypted before being sent to the cloud provider, so the provider never has access to plaintext or keys, meeting the requirement of zero provider visibility.
- ✗
Server-side encryption with customer-managed keys
Why it's wrong here
Server-side encryption with customer-managed keys still involves the provider managing the encryption process, meaning the provider could potentially access the keys and decrypt data.
- ✗
Server-side encryption with customer-supplied keys
Why it's wrong here
Server-side encryption with customer-supplied keys allows the customer to provide the key, but the provider still performs the encryption and may have access to the key during processing.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.