hardMultiple ChoiceObjective-mapped
CCSP Practice Question: A financial institution uses a cloud-based data…
A financial institution uses a cloud-based data warehouse to store customer transaction records. They must comply with a regulation that requires deletion of data after 7 years. Which approach should they use to ensure data is irrecoverably destroyed?
⚠ Common exam trap
ISC2 often tests the misconception that simply deleting data via the cloud provider's API or overwriting data is sufficient for irrecoverable destruction, but the trap is that cloud storage systems maintain multiple copies, snapshots, and version histories that are not addressed by these methods, making cryptographic erasure the only practical option for compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encrypt the data and then destroy the encryption keys (cryptographic erasure)
Cryptographic erasure (Option B) is the correct approach because it renders the encrypted data irrecoverable by securely destroying the encryption keys, making the ciphertext permanently undecipherable. This method is recognized by standards like NIST SP 800-88 as an effective sanitization technique for data at rest, especially in cloud environments where physical access to storage media is unavailable. It ensures compliance with the 7-year deletion requirement without needing to overwrite or physically destroy the underlying cloud storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Overwrite the data with multiple patterns of zeros and ones
Why it's wrong here
Overwriting may not be reliable in virtualized cloud storage with snapshots and copies.
- ✓
Encrypt the data and then destroy the encryption keys (cryptographic erasure)
Why this is correct
Cryptographic erasure renders data unreadable without keys.
- ✗
Tokenize the data and retain the token mapping
Why it's wrong here
Tokenization does not destroy the original data.
- ✗
Delete the data using the cloud provider's API and remove pointers
Why it's wrong here
API deletion may not remove all residual copies.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.