CCSP Cloud Data Security Practice Question
A financial services company is migrating sensitive customer data to the cloud. They require that encryption keys be generated and stored on-premises in their own hardware security module (HSM), with the cloud provider never having access to the plaintext keys. Which key management model should they implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hold your own key (HYOK)
HYOK (Hold Your Own Key) allows the customer to keep keys on-premises in their own HSM, never exposing them to the cloud provider. This provides maximum control but can introduce latency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Customer-managed encryption keys (CMEK)
Why it's wrong here
CMEK uses keys created and managed by the customer in the cloud KMS, but the keys are still stored in the cloud.
- ✗
Bring your own key (BYOK)
Why it's wrong here
BYOK allows importing keys generated on-premises into the cloud KMS, but once imported, the cloud provider has access to the key material.
- ✗
Cloud provider default encryption (SSE-S3)
Why it's wrong here
The cloud provider manages the keys, which does not meet the requirement of keeping keys on-premises.
- ✓
Hold your own key (HYOK)
Why this is correct
HYOK keeps keys on-premises in the customer's HSM, and the cloud provider does not have access to the plaintext keys.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.