CCSP Cloud Application Security Practice Question
A SaaS provider uses a customer-managed encryption key (CMEK) model for data-at-rest. The provider's application runs in a multi-tenant cloud environment. Which attack surface is MOST directly mitigated by this approach?
⚠ Common exam trap
ISC2 often tests the misconception that encryption alone prevents all data exposure, but the trap here is that candidates confuse data-at-rest encryption with access control or application security, failing to recognize that CMEK specifically addresses the insider threat from the cloud provider's staff who might otherwise access raw storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insider threats from cloud provider employees
A customer-managed encryption key (CMEK) model gives the customer control over the key used to encrypt data at rest. This directly mitigates the risk of a cloud provider employee accessing the plaintext data, because even if the employee has administrative access to the storage infrastructure, they cannot decrypt the data without the customer's key. The provider holds the encrypted data, but the decryption key is managed and controlled by the customer, creating a logical separation that protects against insider threats from the provider's personnel.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Misconfigured storage buckets exposing data
Why it's wrong here
Misconfigurations are access control issues, not key management.
- ✓
Insider threats from cloud provider employees
Why this is correct
CMEK prevents provider access to customer data without the key.
- ✗
SQL injection vulnerabilities in the application
Why it's wrong here
CMEK does not prevent code injection attacks.
- ✗
Side-channel attacks on shared physical hardware
Why it's wrong here
Side-channel attacks are mitigated by isolation, not encryption keys.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.