CCSP Cloud Application Security Practice Question
A security team is reviewing controls for a cloud application that transmits personally identifiable information (PII) over the internet. Which TWO controls are essential for protecting data in transit?
⚠ Common exam trap
ISC2 often tests the distinction between 'essential' controls for data in transit versus 'helpful' or 'related' controls, so candidates mistakenly pick IPsec VPNs (Option C) because they associate VPNs with secure transmission, even though TLS is the standard and essential control for web-based cloud applications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use of signed certificates from a trusted CA
Signed certificates from a trusted Certificate Authority (CA) are essential for authenticating the server's identity and establishing a chain of trust. Without them, a client cannot verify that it is communicating with the legitimate server, making the connection vulnerable to man-in-the-middle (MITM) attacks. This is a foundational requirement for any secure communication channel over the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use of signed certificates from a trusted CA
Why this is correct
Certificates provide authentication and enable trust in TLS connections.
- ✗
Regular penetration testing
Why it's wrong here
Pen testing identifies vulnerabilities but does not protect data in transit directly.
- ✗
Implementation of IPsec VPNs
Why it's wrong here
IPsec VPNs are for network-to-network encryption, not general purpose.
- ✓
Use of TLS 1.2 or higher
Why this is correct
TLS encrypts data in transit between client and server.
- ✗
Encryption at rest using AES-256
Why it's wrong here
Encryption at rest protects stored data, not data in transit.
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.