hardMultiple Choice
CCSP Practice Question: A financial institution uses a cloud-based data…
A financial institution uses a cloud-based data warehouse to store customer transaction records. They must comply with a regulation that requires deletion of data after 7 years. Which approach should they use to ensure data is irrecoverably destroyed?
⚠ Common exam trap
ISC2 often tests the misconception that simply deleting data via the cloud provider's API or overwriting data is sufficient for irrecoverable destruction, but the trap is that cloud storage systems maintain multiple copies, snapshots, and version histories that are not addressed by these methods, making cryptographic erasure the only practical option for compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypt the data and then destroy the encryption keys (cryptographic erasure)
Cryptographic erasure (Option B) is the correct approach because it renders the encrypted data irrecoverable by securely destroying the encryption keys, making the ciphertext permanently undecipherable. This method is recognized by standards like NIST SP 800-88 as an effective sanitization technique for data at rest, especially in cloud environments where physical access to storage media is unavailable. It ensures compliance with the 7-year deletion requirement without needing to overwrite or physically destroy the underlying cloud storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Overwrite the data with multiple patterns of zeros and ones
Why it's wrong here
Overwriting with patterns assumes direct block-level access, which multi-tenant cloud storage does not expose; the provider manages physical media and replication. It suits on-premises magnetic disks you control. In cloud warehouses, crypto-shredding — destroying the customer-managed key — renders data irrecoverable instead.
- ✓
Encrypt the data and then destroy the encryption keys (cryptographic erasure)
Why this is correct
Cryptographic erasure renders data unrecoverable by destroying the keys protecting it, rather than overwriting every stored object. This satisfies the seven-year deletion mandate across a cloud warehouse where physical media cannot be accessed or reliably wiped.
- ✗
Tokenize the data and retain the token mapping
Why it's wrong here
Tokenisation replaces sensitive values with surrogate tokens while the mapping vault retains the original data, so records remain recoverable and the regulation's destruction requirement is unmet. It suits reducing PCI DSS scope in live systems, not end-of-life erasure. Irrecoverable destruction needs the mapping itself destroyed.
- ✗
Delete the data using the cloud provider's API and remove pointers
Why it's wrong here
API deletion removes pointers and metadata but the underlying blocks may persist in provider storage, snapshots or backups, so irrecoverability is not guaranteed. It suits routine data lifecycle cleanup where recoverability is acceptable. Regulatory destruction requires cryptographic erasure of the encryption keys protecting the data.
Go deeper
Related to this question
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.