hardMultiple ChoiceObjective-mapped
CCSP Practice Question: A large enterprise is migrating its data center…
A large enterprise is migrating its data center workloads to a public cloud. The security policy requires that all sensitive data stored in cloud storage services be encrypted with keys managed by the enterprise's on-premises HSM. The cloud storage service offers server-side encryption with customer-provided keys. However, compliance regulations prohibit the transmission of encryption keys over the public internet. The enterprise also has a dedicated network connection to the cloud provider. The security team is considering several options. Which solution meets all requirements: (1) data encrypted at rest on the cloud service, (2) keys controlled by the enterprise, (3) keys never transmitted over the internet?
⚠ Common exam trap
ISC2 often tests the misconception that a private or dedicated network connection satisfies a 'no transmission over the internet' requirement, but the trap here is that the regulation prohibits any network transmission of keys, not just over the public internet, so even a private link is disallowed if keys are sent over it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use client-side encryption on-premises before uploading data, using keys from the HSM.
Client-side encryption encrypts data on-premises using keys from the enterprise's HSM before the data is ever transmitted to the cloud. This ensures the data is encrypted at rest in the cloud, the enterprise retains full control of the keys, and the keys never traverse any network—public or private—to the cloud provider. The dedicated network connection is irrelevant for key transmission since the keys never leave the on-premises HSM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a cloud-based HSM and keep the key material in the cloud HSM.
Why it's wrong here
This does not meet the requirement because keys are stored in a cloud HSM, not controlled exclusively by the enterprise on-premises.
- ✗
Use server-side encryption with customer-provided keys with the enterprise's HSM, sending keys over the dedicated network connection as it is private.
Why it's wrong here
Although the keys are sent over a dedicated connection, the regulation prohibits any network transmission of keys, even over a private link.
- ✗
Use server-side encryption with a key management service using an imported key material protected by the enterprise's HSM, accessed via the key management service API over the dedicated network connection.
Why it's wrong here
This still requires transmission of keys over the network via the key management service API, which is prohibited.
- ✓
Use client-side encryption on-premises before uploading data, using keys from the HSM.
Why this is correct
Correct. Client-side encryption ensures keys never leave the on-premises HSM.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.