CCSP Cloud Application Security Practice Question
A media streaming company uses a multi-cloud strategy with AWS and GCP. Their application uses a message queue (Amazon SQS and Google Pub/Sub) for asynchronous processing. The security team discovers that messages contain sensitive user data (e.g., email addresses) that are not encrypted at the broker level. The compliance team mandates encryption of data at rest and in transit for all sensitive data. However, the application already uses TLS for message delivery. What is the most secure and operationally efficient way to meet compliance?
⚠ Common exam trap
ISC2 often tests the misconception that server-side encryption (SSE) alone satisfies 'encryption at rest' requirements, but the trap here is that SSE does not protect data from exposure within the broker's internal processing or logs, and client-side encryption is the only way to guarantee end-to-end confidentiality across heterogeneous multi-cloud environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement client-side encryption of message payloads before sending to the queue, using a centralized key management service
Client-side encryption ensures that sensitive data is encrypted before it ever leaves the application, meeting the compliance mandate for encryption at rest and in transit regardless of the broker's native encryption capabilities. Since TLS already protects data in transit, adding client-side encryption with a centralized key management service (e.g., AWS KMS or GCP Cloud KMS) provides end-to-end confidentiality: the message payload is encrypted by the producer, remains encrypted in the queue, and is decrypted only by the authorized consumer. This approach is operationally efficient because it avoids vendor lock-in and works uniformly across AWS SQS and GCP Pub/Sub without relying on broker-specific SSE features that may not cover all states (e.g., broker logs or backups).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable server-side encryption with SQS (SSE-SQS) and Pub/Sub (CSEK) and rely on TLS for in transit
Why it's wrong here
Server-side encryption protects data at rest only; data in transit is covered by TLS, but data is briefly unencrypted on the broker during processing.
- ✗
Separate sensitive and non-sensitive messages into different queues with different retention policies
Why it's wrong here
Separation does not encrypt the data itself.
- ✓
Implement client-side encryption of message payloads before sending to the queue, using a centralized key management service
Why this is correct
Client-side encryption ensures data is encrypted end-to-end, both in transit and at rest in the broker.
- ✗
Use a third-party encryption gateway that wraps messages before they reach the queues
Why it's wrong here
A gateway adds latency and a single point of failure; client-side encryption is more direct.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.